xref: /titanic_52/usr/src/lib/libdtrace/common/dt_proc.c (revision f6e214c7418f43af38bd8c3a557e3d0a1d311cfa)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*
28  * DTrace Process Control
29  *
30  * This file provides a set of routines that permit libdtrace and its clients
31  * to create and grab process handles using libproc, and to share these handles
32  * between library mechanisms that need libproc access, such as ustack(), and
33  * client mechanisms that need libproc access, such as dtrace(1M) -c and -p.
34  * The library provides several mechanisms in the libproc control layer:
35  *
36  * Reference Counting: The library code and client code can independently grab
37  * the same process handles without interfering with one another.  Only when
38  * the reference count drops to zero and the handle is not being cached (see
39  * below for more information on caching) will Prelease() be called on it.
40  *
41  * Handle Caching: If a handle is grabbed PGRAB_RDONLY (e.g. by ustack()) and
42  * the reference count drops to zero, the handle is not immediately released.
43  * Instead, libproc handles are maintained on dph_lrulist in order from most-
44  * recently accessed to least-recently accessed.  Idle handles are maintained
45  * until a pre-defined LRU cache limit is exceeded, permitting repeated calls
46  * to ustack() to avoid the overhead of releasing and re-grabbing processes.
47  *
48  * Process Control: For processes that are grabbed for control (~PGRAB_RDONLY)
49  * or created by dt_proc_create(), a control thread is created to provide
50  * callbacks on process exit and symbol table caching on dlopen()s.
51  *
52  * MT-Safety: Libproc is not MT-Safe, so dt_proc_lock() and dt_proc_unlock()
53  * are provided to synchronize access to the libproc handle between libdtrace
54  * code and client code and the control thread's use of the ps_prochandle.
55  *
56  * NOTE: MT-Safety is NOT provided for libdtrace itself, or for use of the
57  * dtrace_proc_grab/dtrace_proc_create mechanisms.  Like all exported libdtrace
58  * calls, these are assumed to be MT-Unsafe.  MT-Safety is ONLY provided for
59  * synchronization between libdtrace control threads and the client thread.
60  *
61  * The ps_prochandles themselves are maintained along with a dt_proc_t struct
62  * in a hash table indexed by PID.  This provides basic locking and reference
63  * counting.  The dt_proc_t is also maintained in LRU order on dph_lrulist.
64  * The dph_lrucnt and dph_lrulim count the number of cacheable processes and
65  * the current limit on the number of actively cached entries.
66  *
67  * The control thread for a process establishes breakpoints at the rtld_db
68  * locations of interest, updates mappings and symbol tables at these points,
69  * and handles exec and fork (by always following the parent).  The control
70  * thread automatically exits when the process dies or control is lost.
71  *
72  * A simple notification mechanism is provided for libdtrace clients using
73  * dtrace_handle_proc() for notification of PS_UNDEAD or PS_LOST events.  If
74  * such an event occurs, the dt_proc_t itself is enqueued on a notification
75  * list and the control thread broadcasts to dph_cv.  dtrace_sleep() will wake
76  * up using this condition and will then call the client handler as necessary.
77  */
78 
79 #include <sys/wait.h>
80 #include <sys/lwp.h>
81 #include <strings.h>
82 #include <signal.h>
83 #include <assert.h>
84 #include <errno.h>
85 
86 #include <dt_proc.h>
87 #include <dt_pid.h>
88 #include <dt_impl.h>
89 
90 #define	IS_SYS_EXEC(w)	(w == SYS_execve)
91 #define	IS_SYS_FORK(w)	(w == SYS_vfork || w == SYS_forksys)
92 
93 static dt_bkpt_t *
94 dt_proc_bpcreate(dt_proc_t *dpr, uintptr_t addr, dt_bkpt_f *func, void *data)
95 {
96 	struct ps_prochandle *P = dpr->dpr_proc;
97 	dt_bkpt_t *dbp;
98 
99 	assert(MUTEX_HELD(&dpr->dpr_lock));
100 
101 	if ((dbp = dt_zalloc(dpr->dpr_hdl, sizeof (dt_bkpt_t))) != NULL) {
102 		dbp->dbp_func = func;
103 		dbp->dbp_data = data;
104 		dbp->dbp_addr = addr;
105 
106 		if (Psetbkpt(P, dbp->dbp_addr, &dbp->dbp_instr) == 0)
107 			dbp->dbp_active = B_TRUE;
108 
109 		dt_list_append(&dpr->dpr_bps, dbp);
110 	}
111 
112 	return (dbp);
113 }
114 
115 static void
116 dt_proc_bpdestroy(dt_proc_t *dpr, int delbkpts)
117 {
118 	int state = Pstate(dpr->dpr_proc);
119 	dt_bkpt_t *dbp, *nbp;
120 
121 	assert(MUTEX_HELD(&dpr->dpr_lock));
122 
123 	for (dbp = dt_list_next(&dpr->dpr_bps); dbp != NULL; dbp = nbp) {
124 		if (delbkpts && dbp->dbp_active &&
125 		    state != PS_LOST && state != PS_UNDEAD) {
126 			(void) Pdelbkpt(dpr->dpr_proc,
127 			    dbp->dbp_addr, dbp->dbp_instr);
128 		}
129 		nbp = dt_list_next(dbp);
130 		dt_list_delete(&dpr->dpr_bps, dbp);
131 		dt_free(dpr->dpr_hdl, dbp);
132 	}
133 }
134 
135 static void
136 dt_proc_bpmatch(dtrace_hdl_t *dtp, dt_proc_t *dpr)
137 {
138 	const lwpstatus_t *psp = &Pstatus(dpr->dpr_proc)->pr_lwp;
139 	dt_bkpt_t *dbp;
140 
141 	assert(MUTEX_HELD(&dpr->dpr_lock));
142 
143 	for (dbp = dt_list_next(&dpr->dpr_bps);
144 	    dbp != NULL; dbp = dt_list_next(dbp)) {
145 		if (psp->pr_reg[R_PC] == dbp->dbp_addr)
146 			break;
147 	}
148 
149 	if (dbp == NULL) {
150 		dt_dprintf("pid %d: spurious breakpoint wakeup for %lx\n",
151 		    (int)dpr->dpr_pid, (ulong_t)psp->pr_reg[R_PC]);
152 		return;
153 	}
154 
155 	dt_dprintf("pid %d: hit breakpoint at %lx (%lu)\n",
156 	    (int)dpr->dpr_pid, (ulong_t)dbp->dbp_addr, ++dbp->dbp_hits);
157 
158 	dbp->dbp_func(dtp, dpr, dbp->dbp_data);
159 	(void) Pxecbkpt(dpr->dpr_proc, dbp->dbp_instr);
160 }
161 
162 static void
163 dt_proc_bpenable(dt_proc_t *dpr)
164 {
165 	dt_bkpt_t *dbp;
166 
167 	assert(MUTEX_HELD(&dpr->dpr_lock));
168 
169 	for (dbp = dt_list_next(&dpr->dpr_bps);
170 	    dbp != NULL; dbp = dt_list_next(dbp)) {
171 		if (!dbp->dbp_active && Psetbkpt(dpr->dpr_proc,
172 		    dbp->dbp_addr, &dbp->dbp_instr) == 0)
173 			dbp->dbp_active = B_TRUE;
174 	}
175 
176 	dt_dprintf("breakpoints enabled\n");
177 }
178 
179 static void
180 dt_proc_bpdisable(dt_proc_t *dpr)
181 {
182 	dt_bkpt_t *dbp;
183 
184 	assert(MUTEX_HELD(&dpr->dpr_lock));
185 
186 	for (dbp = dt_list_next(&dpr->dpr_bps);
187 	    dbp != NULL; dbp = dt_list_next(dbp)) {
188 		if (dbp->dbp_active && Pdelbkpt(dpr->dpr_proc,
189 		    dbp->dbp_addr, dbp->dbp_instr) == 0)
190 			dbp->dbp_active = B_FALSE;
191 	}
192 
193 	dt_dprintf("breakpoints disabled\n");
194 }
195 
196 static void
197 dt_proc_notify(dtrace_hdl_t *dtp, dt_proc_hash_t *dph, dt_proc_t *dpr,
198     const char *msg)
199 {
200 	dt_proc_notify_t *dprn = dt_alloc(dtp, sizeof (dt_proc_notify_t));
201 
202 	if (dprn == NULL) {
203 		dt_dprintf("failed to allocate notification for %d %s\n",
204 		    (int)dpr->dpr_pid, msg);
205 	} else {
206 		dprn->dprn_dpr = dpr;
207 		if (msg == NULL)
208 			dprn->dprn_errmsg[0] = '\0';
209 		else
210 			(void) strlcpy(dprn->dprn_errmsg, msg,
211 			    sizeof (dprn->dprn_errmsg));
212 
213 		(void) pthread_mutex_lock(&dph->dph_lock);
214 
215 		dprn->dprn_next = dph->dph_notify;
216 		dph->dph_notify = dprn;
217 
218 		(void) pthread_cond_broadcast(&dph->dph_cv);
219 		(void) pthread_mutex_unlock(&dph->dph_lock);
220 	}
221 }
222 
223 /*
224  * Check to see if the control thread was requested to stop when the victim
225  * process reached a particular event (why) rather than continuing the victim.
226  * If 'why' is set in the stop mask, we wait on dpr_cv for dt_proc_continue().
227  * If 'why' is not set, this function returns immediately and does nothing.
228  */
229 static void
230 dt_proc_stop(dt_proc_t *dpr, uint8_t why)
231 {
232 	assert(MUTEX_HELD(&dpr->dpr_lock));
233 	assert(why != DT_PROC_STOP_IDLE);
234 
235 	if (dpr->dpr_stop & why) {
236 		dpr->dpr_stop |= DT_PROC_STOP_IDLE;
237 		dpr->dpr_stop &= ~why;
238 
239 		(void) pthread_cond_broadcast(&dpr->dpr_cv);
240 
241 		/*
242 		 * We disable breakpoints while stopped to preserve the
243 		 * integrity of the program text for both our own disassembly
244 		 * and that of the kernel.
245 		 */
246 		dt_proc_bpdisable(dpr);
247 
248 		while (dpr->dpr_stop & DT_PROC_STOP_IDLE)
249 			(void) pthread_cond_wait(&dpr->dpr_cv, &dpr->dpr_lock);
250 
251 		dt_proc_bpenable(dpr);
252 	}
253 }
254 
255 /*ARGSUSED*/
256 static void
257 dt_proc_bpmain(dtrace_hdl_t *dtp, dt_proc_t *dpr, const char *fname)
258 {
259 	dt_dprintf("pid %d: breakpoint at %s()\n", (int)dpr->dpr_pid, fname);
260 	dt_proc_stop(dpr, DT_PROC_STOP_MAIN);
261 }
262 
263 static void
264 dt_proc_rdevent(dtrace_hdl_t *dtp, dt_proc_t *dpr, const char *evname)
265 {
266 	rd_event_msg_t rdm;
267 	rd_err_e err;
268 
269 	if ((err = rd_event_getmsg(dpr->dpr_rtld, &rdm)) != RD_OK) {
270 		dt_dprintf("pid %d: failed to get %s event message: %s\n",
271 		    (int)dpr->dpr_pid, evname, rd_errstr(err));
272 		return;
273 	}
274 
275 	dt_dprintf("pid %d: rtld event %s type=%d state %d\n",
276 	    (int)dpr->dpr_pid, evname, rdm.type, rdm.u.state);
277 
278 	switch (rdm.type) {
279 	case RD_DLACTIVITY:
280 		if (rdm.u.state != RD_CONSISTENT)
281 			break;
282 
283 		Pupdate_syms(dpr->dpr_proc);
284 		if (dt_pid_create_probes_module(dtp, dpr) != 0)
285 			dt_proc_notify(dtp, dtp->dt_procs, dpr,
286 			    dpr->dpr_errmsg);
287 
288 		break;
289 	case RD_PREINIT:
290 		Pupdate_syms(dpr->dpr_proc);
291 		dt_proc_stop(dpr, DT_PROC_STOP_PREINIT);
292 		break;
293 	case RD_POSTINIT:
294 		Pupdate_syms(dpr->dpr_proc);
295 		dt_proc_stop(dpr, DT_PROC_STOP_POSTINIT);
296 		break;
297 	}
298 }
299 
300 static void
301 dt_proc_rdwatch(dt_proc_t *dpr, rd_event_e event, const char *evname)
302 {
303 	rd_notify_t rdn;
304 	rd_err_e err;
305 
306 	if ((err = rd_event_addr(dpr->dpr_rtld, event, &rdn)) != RD_OK) {
307 		dt_dprintf("pid %d: failed to get event address for %s: %s\n",
308 		    (int)dpr->dpr_pid, evname, rd_errstr(err));
309 		return;
310 	}
311 
312 	if (rdn.type != RD_NOTIFY_BPT) {
313 		dt_dprintf("pid %d: event %s has unexpected type %d\n",
314 		    (int)dpr->dpr_pid, evname, rdn.type);
315 		return;
316 	}
317 
318 	(void) dt_proc_bpcreate(dpr, rdn.u.bptaddr,
319 	    (dt_bkpt_f *)dt_proc_rdevent, (void *)evname);
320 }
321 
322 /*
323  * Common code for enabling events associated with the run-time linker after
324  * attaching to a process or after a victim process completes an exec(2).
325  */
326 static void
327 dt_proc_attach(dt_proc_t *dpr, int exec)
328 {
329 	const pstatus_t *psp = Pstatus(dpr->dpr_proc);
330 	rd_err_e err;
331 	GElf_Sym sym;
332 
333 	assert(MUTEX_HELD(&dpr->dpr_lock));
334 
335 	if (exec) {
336 		if (psp->pr_lwp.pr_errno != 0)
337 			return; /* exec failed: nothing needs to be done */
338 
339 		dt_proc_bpdestroy(dpr, B_FALSE);
340 		Preset_maps(dpr->dpr_proc);
341 	}
342 
343 	if ((dpr->dpr_rtld = Prd_agent(dpr->dpr_proc)) != NULL &&
344 	    (err = rd_event_enable(dpr->dpr_rtld, B_TRUE)) == RD_OK) {
345 		dt_proc_rdwatch(dpr, RD_PREINIT, "RD_PREINIT");
346 		dt_proc_rdwatch(dpr, RD_POSTINIT, "RD_POSTINIT");
347 		dt_proc_rdwatch(dpr, RD_DLACTIVITY, "RD_DLACTIVITY");
348 	} else {
349 		dt_dprintf("pid %d: failed to enable rtld events: %s\n",
350 		    (int)dpr->dpr_pid, dpr->dpr_rtld ? rd_errstr(err) :
351 		    "rtld_db agent initialization failed");
352 	}
353 
354 	Pupdate_maps(dpr->dpr_proc);
355 
356 	if (Pxlookup_by_name(dpr->dpr_proc, LM_ID_BASE,
357 	    "a.out", "main", &sym, NULL) == 0) {
358 		(void) dt_proc_bpcreate(dpr, (uintptr_t)sym.st_value,
359 		    (dt_bkpt_f *)dt_proc_bpmain, "a.out`main");
360 	} else {
361 		dt_dprintf("pid %d: failed to find a.out`main: %s\n",
362 		    (int)dpr->dpr_pid, strerror(errno));
363 	}
364 }
365 
366 /*
367  * Wait for a stopped process to be set running again by some other debugger.
368  * This is typically not required by /proc-based debuggers, since the usual
369  * model is that one debugger controls one victim.  But DTrace, as usual, has
370  * its own needs: the stop() action assumes that prun(1) or some other tool
371  * will be applied to resume the victim process.  This could be solved by
372  * adding a PCWRUN directive to /proc, but that seems like overkill unless
373  * other debuggers end up needing this functionality, so we implement a cheap
374  * equivalent to PCWRUN using the set of existing kernel mechanisms.
375  *
376  * Our intent is really not just to wait for the victim to run, but rather to
377  * wait for it to run and then stop again for a reason other than the current
378  * PR_REQUESTED stop.  Since PCWSTOP/Pstopstatus() can be applied repeatedly
379  * to a stopped process and will return the same result without affecting the
380  * victim, we can just perform these operations repeatedly until Pstate()
381  * changes, the representative LWP ID changes, or the stop timestamp advances.
382  * dt_proc_control() will then rediscover the new state and continue as usual.
383  * When the process is still stopped in the same exact state, we sleep for a
384  * brief interval before waiting again so as not to spin consuming CPU cycles.
385  */
386 static void
387 dt_proc_waitrun(dt_proc_t *dpr)
388 {
389 	struct ps_prochandle *P = dpr->dpr_proc;
390 	const lwpstatus_t *psp = &Pstatus(P)->pr_lwp;
391 
392 	int krflag = psp->pr_flags & (PR_KLC | PR_RLC);
393 	timestruc_t tstamp = psp->pr_tstamp;
394 	lwpid_t lwpid = psp->pr_lwpid;
395 
396 	const long wstop = PCWSTOP;
397 	int pfd = Pctlfd(P);
398 
399 	assert(MUTEX_HELD(&dpr->dpr_lock));
400 	assert(psp->pr_flags & PR_STOPPED);
401 	assert(Pstate(P) == PS_STOP);
402 
403 	/*
404 	 * While we are waiting for the victim to run, clear PR_KLC and PR_RLC
405 	 * so that if the libdtrace client is killed, the victim stays stopped.
406 	 * dt_proc_destroy() will also observe this and perform PRELEASE_HANG.
407 	 */
408 	(void) Punsetflags(P, krflag);
409 	Psync(P);
410 
411 	(void) pthread_mutex_unlock(&dpr->dpr_lock);
412 
413 	while (!dpr->dpr_quit) {
414 		if (write(pfd, &wstop, sizeof (wstop)) == -1 && errno == EINTR)
415 			continue; /* check dpr_quit and continue waiting */
416 
417 		(void) pthread_mutex_lock(&dpr->dpr_lock);
418 		(void) Pstopstatus(P, PCNULL, 0);
419 		psp = &Pstatus(P)->pr_lwp;
420 
421 		/*
422 		 * If we've reached a new state, found a new representative, or
423 		 * the stop timestamp has changed, restore PR_KLC/PR_RLC to its
424 		 * original setting and then return with dpr_lock held.
425 		 */
426 		if (Pstate(P) != PS_STOP || psp->pr_lwpid != lwpid ||
427 		    bcmp(&psp->pr_tstamp, &tstamp, sizeof (tstamp)) != 0) {
428 			(void) Psetflags(P, krflag);
429 			Psync(P);
430 			return;
431 		}
432 
433 		(void) pthread_mutex_unlock(&dpr->dpr_lock);
434 		(void) poll(NULL, 0, MILLISEC / 2);
435 	}
436 
437 	(void) pthread_mutex_lock(&dpr->dpr_lock);
438 }
439 
440 typedef struct dt_proc_control_data {
441 	dtrace_hdl_t *dpcd_hdl;			/* DTrace handle */
442 	dt_proc_t *dpcd_proc;			/* proccess to control */
443 } dt_proc_control_data_t;
444 
445 /*
446  * Main loop for all victim process control threads.  We initialize all the
447  * appropriate /proc control mechanisms, and then enter a loop waiting for
448  * the process to stop on an event or die.  We process any events by calling
449  * appropriate subroutines, and exit when the victim dies or we lose control.
450  *
451  * The control thread synchronizes the use of dpr_proc with other libdtrace
452  * threads using dpr_lock.  We hold the lock for all of our operations except
453  * waiting while the process is running: this is accomplished by writing a
454  * PCWSTOP directive directly to the underlying /proc/<pid>/ctl file.  If the
455  * libdtrace client wishes to exit or abort our wait, SIGCANCEL can be used.
456  */
457 static void *
458 dt_proc_control(void *arg)
459 {
460 	dt_proc_control_data_t *datap = arg;
461 	dtrace_hdl_t *dtp = datap->dpcd_hdl;
462 	dt_proc_t *dpr = datap->dpcd_proc;
463 	dt_proc_hash_t *dph = dpr->dpr_hdl->dt_procs;
464 	struct ps_prochandle *P = dpr->dpr_proc;
465 
466 	int pfd = Pctlfd(P);
467 	int pid = dpr->dpr_pid;
468 
469 	const long wstop = PCWSTOP;
470 	int notify = B_FALSE;
471 
472 	/*
473 	 * We disable the POSIX thread cancellation mechanism so that the
474 	 * client program using libdtrace can't accidentally cancel our thread.
475 	 * dt_proc_destroy() uses SIGCANCEL explicitly to simply poke us out
476 	 * of PCWSTOP with EINTR, at which point we will see dpr_quit and exit.
477 	 */
478 	(void) pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL);
479 
480 	/*
481 	 * Set up the corresponding process for tracing by libdtrace.  We want
482 	 * to be able to catch breakpoints and efficiently single-step over
483 	 * them, and we need to enable librtld_db to watch libdl activity.
484 	 */
485 	(void) pthread_mutex_lock(&dpr->dpr_lock);
486 
487 	(void) Punsetflags(P, PR_ASYNC);	/* require synchronous mode */
488 	(void) Psetflags(P, PR_BPTADJ);		/* always adjust eip on x86 */
489 	(void) Punsetflags(P, PR_FORK);		/* do not inherit on fork */
490 
491 	(void) Pfault(P, FLTBPT, B_TRUE);	/* always trace breakpoints */
492 	(void) Pfault(P, FLTTRACE, B_TRUE);	/* always trace single-step */
493 
494 	/*
495 	 * We must trace exit from exec() system calls so that if the exec is
496 	 * successful, we can reset our breakpoints and re-initialize libproc.
497 	 */
498 	(void) Psysexit(P, SYS_execve, B_TRUE);
499 
500 	/*
501 	 * We must trace entry and exit for fork() system calls in order to
502 	 * disable our breakpoints temporarily during the fork.  We do not set
503 	 * the PR_FORK flag, so if fork succeeds the child begins executing and
504 	 * does not inherit any other tracing behaviors or a control thread.
505 	 */
506 	(void) Psysentry(P, SYS_vfork, B_TRUE);
507 	(void) Psysexit(P, SYS_vfork, B_TRUE);
508 	(void) Psysentry(P, SYS_forksys, B_TRUE);
509 	(void) Psysexit(P, SYS_forksys, B_TRUE);
510 
511 	Psync(P);				/* enable all /proc changes */
512 	dt_proc_attach(dpr, B_FALSE);		/* enable rtld breakpoints */
513 
514 	/*
515 	 * If PR_KLC is set, we created the process; otherwise we grabbed it.
516 	 * Check for an appropriate stop request and wait for dt_proc_continue.
517 	 */
518 	if (Pstatus(P)->pr_flags & PR_KLC)
519 		dt_proc_stop(dpr, DT_PROC_STOP_CREATE);
520 	else
521 		dt_proc_stop(dpr, DT_PROC_STOP_GRAB);
522 
523 	if (Psetrun(P, 0, 0) == -1) {
524 		dt_dprintf("pid %d: failed to set running: %s\n",
525 		    (int)dpr->dpr_pid, strerror(errno));
526 	}
527 
528 	(void) pthread_mutex_unlock(&dpr->dpr_lock);
529 
530 	/*
531 	 * Wait for the process corresponding to this control thread to stop,
532 	 * process the event, and then set it running again.  We want to sleep
533 	 * with dpr_lock *unheld* so that other parts of libdtrace can use the
534 	 * ps_prochandle in the meantime (e.g. ustack()).  To do this, we write
535 	 * a PCWSTOP directive directly to the underlying /proc/<pid>/ctl file.
536 	 * Once the process stops, we wake up, grab dpr_lock, and then call
537 	 * Pwait() (which will return immediately) and do our processing.
538 	 */
539 	while (!dpr->dpr_quit) {
540 		const lwpstatus_t *psp;
541 
542 		if (write(pfd, &wstop, sizeof (wstop)) == -1 && errno == EINTR)
543 			continue; /* check dpr_quit and continue waiting */
544 
545 		(void) pthread_mutex_lock(&dpr->dpr_lock);
546 pwait_locked:
547 		if (Pstopstatus(P, PCNULL, 0) == -1 && errno == EINTR) {
548 			(void) pthread_mutex_unlock(&dpr->dpr_lock);
549 			continue; /* check dpr_quit and continue waiting */
550 		}
551 
552 		switch (Pstate(P)) {
553 		case PS_STOP:
554 			psp = &Pstatus(P)->pr_lwp;
555 
556 			dt_dprintf("pid %d: proc stopped showing %d/%d\n",
557 			    pid, psp->pr_why, psp->pr_what);
558 
559 			/*
560 			 * If the process stops showing PR_REQUESTED, then the
561 			 * DTrace stop() action was applied to it or another
562 			 * debugging utility (e.g. pstop(1)) asked it to stop.
563 			 * In either case, the user's intention is for the
564 			 * process to remain stopped until another external
565 			 * mechanism (e.g. prun(1)) is applied.  So instead of
566 			 * setting the process running ourself, we wait for
567 			 * someone else to do so.  Once that happens, we return
568 			 * to our normal loop waiting for an event of interest.
569 			 */
570 			if (psp->pr_why == PR_REQUESTED) {
571 				dt_proc_waitrun(dpr);
572 				(void) pthread_mutex_unlock(&dpr->dpr_lock);
573 				continue;
574 			}
575 
576 			/*
577 			 * If the process stops showing one of the events that
578 			 * we are tracing, perform the appropriate response.
579 			 * Note that we ignore PR_SUSPENDED, PR_CHECKPOINT, and
580 			 * PR_JOBCONTROL by design: if one of these conditions
581 			 * occurs, we will fall through to Psetrun() but the
582 			 * process will remain stopped in the kernel by the
583 			 * corresponding mechanism (e.g. job control stop).
584 			 */
585 			if (psp->pr_why == PR_FAULTED && psp->pr_what == FLTBPT)
586 				dt_proc_bpmatch(dtp, dpr);
587 			else if (psp->pr_why == PR_SYSENTRY &&
588 			    IS_SYS_FORK(psp->pr_what))
589 				dt_proc_bpdisable(dpr);
590 			else if (psp->pr_why == PR_SYSEXIT &&
591 			    IS_SYS_FORK(psp->pr_what))
592 				dt_proc_bpenable(dpr);
593 			else if (psp->pr_why == PR_SYSEXIT &&
594 			    IS_SYS_EXEC(psp->pr_what))
595 				dt_proc_attach(dpr, B_TRUE);
596 			break;
597 
598 		case PS_LOST:
599 			if (Preopen(P) == 0)
600 				goto pwait_locked;
601 
602 			dt_dprintf("pid %d: proc lost: %s\n",
603 			    pid, strerror(errno));
604 
605 			dpr->dpr_quit = B_TRUE;
606 			notify = B_TRUE;
607 			break;
608 
609 		case PS_UNDEAD:
610 			dt_dprintf("pid %d: proc died\n", pid);
611 			dpr->dpr_quit = B_TRUE;
612 			notify = B_TRUE;
613 			break;
614 		}
615 
616 		if (Pstate(P) != PS_UNDEAD && Psetrun(P, 0, 0) == -1) {
617 			dt_dprintf("pid %d: failed to set running: %s\n",
618 			    (int)dpr->dpr_pid, strerror(errno));
619 		}
620 
621 		(void) pthread_mutex_unlock(&dpr->dpr_lock);
622 	}
623 
624 	/*
625 	 * If the control thread detected PS_UNDEAD or PS_LOST, then enqueue
626 	 * the dt_proc_t structure on the dt_proc_hash_t notification list.
627 	 */
628 	if (notify)
629 		dt_proc_notify(dtp, dph, dpr, NULL);
630 
631 	/*
632 	 * Destroy and remove any remaining breakpoints, set dpr_done and clear
633 	 * dpr_tid to indicate the control thread has exited, and notify any
634 	 * waiting thread in dt_proc_destroy() that we have succesfully exited.
635 	 */
636 	(void) pthread_mutex_lock(&dpr->dpr_lock);
637 
638 	dt_proc_bpdestroy(dpr, B_TRUE);
639 	dpr->dpr_done = B_TRUE;
640 	dpr->dpr_tid = 0;
641 
642 	(void) pthread_cond_broadcast(&dpr->dpr_cv);
643 	(void) pthread_mutex_unlock(&dpr->dpr_lock);
644 
645 	return (NULL);
646 }
647 
648 /*PRINTFLIKE3*/
649 static struct ps_prochandle *
650 dt_proc_error(dtrace_hdl_t *dtp, dt_proc_t *dpr, const char *format, ...)
651 {
652 	va_list ap;
653 
654 	va_start(ap, format);
655 	dt_set_errmsg(dtp, NULL, NULL, NULL, 0, format, ap);
656 	va_end(ap);
657 
658 	if (dpr->dpr_proc != NULL)
659 		Prelease(dpr->dpr_proc, 0);
660 
661 	dt_free(dtp, dpr);
662 	(void) dt_set_errno(dtp, EDT_COMPILER);
663 	return (NULL);
664 }
665 
666 dt_proc_t *
667 dt_proc_lookup(dtrace_hdl_t *dtp, struct ps_prochandle *P, int remove)
668 {
669 	dt_proc_hash_t *dph = dtp->dt_procs;
670 	pid_t pid = Pstatus(P)->pr_pid;
671 	dt_proc_t *dpr, **dpp = &dph->dph_hash[pid & (dph->dph_hashlen - 1)];
672 
673 	for (dpr = *dpp; dpr != NULL; dpr = dpr->dpr_hash) {
674 		if (dpr->dpr_pid == pid)
675 			break;
676 		else
677 			dpp = &dpr->dpr_hash;
678 	}
679 
680 	assert(dpr != NULL);
681 	assert(dpr->dpr_proc == P);
682 
683 	if (remove)
684 		*dpp = dpr->dpr_hash; /* remove from pid hash chain */
685 
686 	return (dpr);
687 }
688 
689 static void
690 dt_proc_destroy(dtrace_hdl_t *dtp, struct ps_prochandle *P)
691 {
692 	dt_proc_t *dpr = dt_proc_lookup(dtp, P, B_FALSE);
693 	dt_proc_hash_t *dph = dtp->dt_procs;
694 	dt_proc_notify_t *npr, **npp;
695 	int rflag;
696 
697 	assert(dpr != NULL);
698 
699 	/*
700 	 * If neither PR_KLC nor PR_RLC is set, then the process is stopped by
701 	 * an external debugger and we were waiting in dt_proc_waitrun().
702 	 * Leave the process in this condition using PRELEASE_HANG.
703 	 */
704 	if (!(Pstatus(dpr->dpr_proc)->pr_flags & (PR_KLC | PR_RLC))) {
705 		dt_dprintf("abandoning pid %d\n", (int)dpr->dpr_pid);
706 		rflag = PRELEASE_HANG;
707 	} else if (Pstatus(dpr->dpr_proc)->pr_flags & PR_KLC) {
708 		dt_dprintf("killing pid %d\n", (int)dpr->dpr_pid);
709 		rflag = PRELEASE_KILL; /* apply kill-on-last-close */
710 	} else {
711 		dt_dprintf("releasing pid %d\n", (int)dpr->dpr_pid);
712 		rflag = 0; /* apply run-on-last-close */
713 	}
714 
715 	if (dpr->dpr_tid) {
716 		/*
717 		 * Set the dpr_quit flag to tell the daemon thread to exit.  We
718 		 * send it a SIGCANCEL to poke it out of PCWSTOP or any other
719 		 * long-term /proc system call.  Our daemon threads have POSIX
720 		 * cancellation disabled, so EINTR will be the only effect.  We
721 		 * then wait for dpr_done to indicate the thread has exited.
722 		 *
723 		 * We can't use pthread_kill() to send SIGCANCEL because the
724 		 * interface forbids it and we can't use pthread_cancel()
725 		 * because with cancellation disabled it won't actually
726 		 * send SIGCANCEL to the target thread, so we use _lwp_kill()
727 		 * to do the job.  This is all built on evil knowledge of
728 		 * the details of the cancellation mechanism in libc.
729 		 */
730 		(void) pthread_mutex_lock(&dpr->dpr_lock);
731 		dpr->dpr_quit = B_TRUE;
732 		(void) _lwp_kill(dpr->dpr_tid, SIGCANCEL);
733 
734 		/*
735 		 * If the process is currently idling in dt_proc_stop(), re-
736 		 * enable breakpoints and poke it into running again.
737 		 */
738 		if (dpr->dpr_stop & DT_PROC_STOP_IDLE) {
739 			dt_proc_bpenable(dpr);
740 			dpr->dpr_stop &= ~DT_PROC_STOP_IDLE;
741 			(void) pthread_cond_broadcast(&dpr->dpr_cv);
742 		}
743 
744 		while (!dpr->dpr_done)
745 			(void) pthread_cond_wait(&dpr->dpr_cv, &dpr->dpr_lock);
746 
747 		(void) pthread_mutex_unlock(&dpr->dpr_lock);
748 	}
749 
750 	/*
751 	 * Before we free the process structure, remove this dt_proc_t from the
752 	 * lookup hash, and then walk the dt_proc_hash_t's notification list
753 	 * and remove this dt_proc_t if it is enqueued.
754 	 */
755 	(void) pthread_mutex_lock(&dph->dph_lock);
756 	(void) dt_proc_lookup(dtp, P, B_TRUE);
757 	npp = &dph->dph_notify;
758 
759 	while ((npr = *npp) != NULL) {
760 		if (npr->dprn_dpr == dpr) {
761 			*npp = npr->dprn_next;
762 			dt_free(dtp, npr);
763 		} else {
764 			npp = &npr->dprn_next;
765 		}
766 	}
767 
768 	(void) pthread_mutex_unlock(&dph->dph_lock);
769 
770 	/*
771 	 * Remove the dt_proc_list from the LRU list, release the underlying
772 	 * libproc handle, and free our dt_proc_t data structure.
773 	 */
774 	if (dpr->dpr_cacheable) {
775 		assert(dph->dph_lrucnt != 0);
776 		dph->dph_lrucnt--;
777 	}
778 
779 	dt_list_delete(&dph->dph_lrulist, dpr);
780 	Prelease(dpr->dpr_proc, rflag);
781 	dt_free(dtp, dpr);
782 }
783 
784 static int
785 dt_proc_create_thread(dtrace_hdl_t *dtp, dt_proc_t *dpr, uint_t stop)
786 {
787 	dt_proc_control_data_t data;
788 	sigset_t nset, oset;
789 	pthread_attr_t a;
790 	int err;
791 
792 	(void) pthread_mutex_lock(&dpr->dpr_lock);
793 	dpr->dpr_stop |= stop; /* set bit for initial rendezvous */
794 
795 	(void) pthread_attr_init(&a);
796 	(void) pthread_attr_setdetachstate(&a, PTHREAD_CREATE_DETACHED);
797 
798 	(void) sigfillset(&nset);
799 	(void) sigdelset(&nset, SIGABRT);	/* unblocked for assert() */
800 	(void) sigdelset(&nset, SIGCANCEL);	/* see dt_proc_destroy() */
801 
802 	data.dpcd_hdl = dtp;
803 	data.dpcd_proc = dpr;
804 
805 	(void) pthread_sigmask(SIG_SETMASK, &nset, &oset);
806 	err = pthread_create(&dpr->dpr_tid, &a, dt_proc_control, &data);
807 	(void) pthread_sigmask(SIG_SETMASK, &oset, NULL);
808 
809 	/*
810 	 * If the control thread was created, then wait on dpr_cv for either
811 	 * dpr_done to be set (the victim died or the control thread failed)
812 	 * or DT_PROC_STOP_IDLE to be set, indicating that the victim is now
813 	 * stopped by /proc and the control thread is at the rendezvous event.
814 	 * On success, we return with the process and control thread stopped:
815 	 * the caller can then apply dt_proc_continue() to resume both.
816 	 */
817 	if (err == 0) {
818 		while (!dpr->dpr_done && !(dpr->dpr_stop & DT_PROC_STOP_IDLE))
819 			(void) pthread_cond_wait(&dpr->dpr_cv, &dpr->dpr_lock);
820 
821 		/*
822 		 * If dpr_done is set, the control thread aborted before it
823 		 * reached the rendezvous event.  This is either due to PS_LOST
824 		 * or PS_UNDEAD (i.e. the process died).  We try to provide a
825 		 * small amount of useful information to help figure it out.
826 		 */
827 		if (dpr->dpr_done) {
828 			const psinfo_t *prp = Ppsinfo(dpr->dpr_proc);
829 			int stat = prp ? prp->pr_wstat : 0;
830 			int pid = dpr->dpr_pid;
831 
832 			if (Pstate(dpr->dpr_proc) == PS_LOST) {
833 				(void) dt_proc_error(dpr->dpr_hdl, dpr,
834 				    "failed to control pid %d: process exec'd "
835 				    "set-id or unobservable program\n", pid);
836 			} else if (WIFSIGNALED(stat)) {
837 				(void) dt_proc_error(dpr->dpr_hdl, dpr,
838 				    "failed to control pid %d: process died "
839 				    "from signal %d\n", pid, WTERMSIG(stat));
840 			} else {
841 				(void) dt_proc_error(dpr->dpr_hdl, dpr,
842 				    "failed to control pid %d: process exited "
843 				    "with status %d\n", pid, WEXITSTATUS(stat));
844 			}
845 
846 			err = ESRCH; /* cause grab() or create() to fail */
847 		}
848 	} else {
849 		(void) dt_proc_error(dpr->dpr_hdl, dpr,
850 		    "failed to create control thread for process-id %d: %s\n",
851 		    (int)dpr->dpr_pid, strerror(err));
852 	}
853 
854 	(void) pthread_mutex_unlock(&dpr->dpr_lock);
855 	(void) pthread_attr_destroy(&a);
856 
857 	return (err);
858 }
859 
860 struct ps_prochandle *
861 dt_proc_create(dtrace_hdl_t *dtp, const char *file, char *const *argv)
862 {
863 	dt_proc_hash_t *dph = dtp->dt_procs;
864 	dt_proc_t *dpr;
865 	int err;
866 
867 	if ((dpr = dt_zalloc(dtp, sizeof (dt_proc_t))) == NULL)
868 		return (NULL); /* errno is set for us */
869 
870 	(void) pthread_mutex_init(&dpr->dpr_lock, NULL);
871 	(void) pthread_cond_init(&dpr->dpr_cv, NULL);
872 
873 	if ((dpr->dpr_proc = Pcreate(file, argv, &err, NULL, 0)) == NULL) {
874 		return (dt_proc_error(dtp, dpr,
875 		    "failed to execute %s: %s\n", file, Pcreate_error(err)));
876 	}
877 
878 	dpr->dpr_hdl = dtp;
879 	dpr->dpr_pid = Pstatus(dpr->dpr_proc)->pr_pid;
880 
881 	(void) Punsetflags(dpr->dpr_proc, PR_RLC);
882 	(void) Psetflags(dpr->dpr_proc, PR_KLC);
883 
884 	if (dt_proc_create_thread(dtp, dpr, dtp->dt_prcmode) != 0)
885 		return (NULL); /* dt_proc_error() has been called for us */
886 
887 	dpr->dpr_hash = dph->dph_hash[dpr->dpr_pid & (dph->dph_hashlen - 1)];
888 	dph->dph_hash[dpr->dpr_pid & (dph->dph_hashlen - 1)] = dpr;
889 	dt_list_prepend(&dph->dph_lrulist, dpr);
890 
891 	dt_dprintf("created pid %d\n", (int)dpr->dpr_pid);
892 	dpr->dpr_refs++;
893 
894 	return (dpr->dpr_proc);
895 }
896 
897 struct ps_prochandle *
898 dt_proc_grab(dtrace_hdl_t *dtp, pid_t pid, int flags, int nomonitor)
899 {
900 	dt_proc_hash_t *dph = dtp->dt_procs;
901 	uint_t h = pid & (dph->dph_hashlen - 1);
902 	dt_proc_t *dpr, *opr;
903 	int err;
904 
905 	/*
906 	 * Search the hash table for the pid.  If it is already grabbed or
907 	 * created, move the handle to the front of the lrulist, increment
908 	 * the reference count, and return the existing ps_prochandle.
909 	 */
910 	for (dpr = dph->dph_hash[h]; dpr != NULL; dpr = dpr->dpr_hash) {
911 		if (dpr->dpr_pid == pid && !dpr->dpr_stale) {
912 			/*
913 			 * If the cached handle was opened read-only and
914 			 * this request is for a writeable handle, mark
915 			 * the cached handle as stale and open a new handle.
916 			 * Since it's stale, unmark it as cacheable.
917 			 */
918 			if (dpr->dpr_rdonly && !(flags & PGRAB_RDONLY)) {
919 				dt_dprintf("upgrading pid %d\n", (int)pid);
920 				dpr->dpr_stale = B_TRUE;
921 				dpr->dpr_cacheable = B_FALSE;
922 				dph->dph_lrucnt--;
923 				break;
924 			}
925 
926 			dt_dprintf("grabbed pid %d (cached)\n", (int)pid);
927 			dt_list_delete(&dph->dph_lrulist, dpr);
928 			dt_list_prepend(&dph->dph_lrulist, dpr);
929 			dpr->dpr_refs++;
930 			return (dpr->dpr_proc);
931 		}
932 	}
933 
934 	if ((dpr = dt_zalloc(dtp, sizeof (dt_proc_t))) == NULL)
935 		return (NULL); /* errno is set for us */
936 
937 	(void) pthread_mutex_init(&dpr->dpr_lock, NULL);
938 	(void) pthread_cond_init(&dpr->dpr_cv, NULL);
939 
940 	if ((dpr->dpr_proc = Pgrab(pid, flags, &err)) == NULL) {
941 		return (dt_proc_error(dtp, dpr,
942 		    "failed to grab pid %d: %s\n", (int)pid, Pgrab_error(err)));
943 	}
944 
945 	dpr->dpr_hdl = dtp;
946 	dpr->dpr_pid = pid;
947 
948 	(void) Punsetflags(dpr->dpr_proc, PR_KLC);
949 	(void) Psetflags(dpr->dpr_proc, PR_RLC);
950 
951 	/*
952 	 * If we are attempting to grab the process without a monitor
953 	 * thread, then mark the process cacheable only if it's being
954 	 * grabbed read-only.  If we're currently caching more process
955 	 * handles than dph_lrulim permits, attempt to find the
956 	 * least-recently-used handle that is currently unreferenced and
957 	 * release it from the cache.  Otherwise we are grabbing the process
958 	 * for control: create a control thread for this process and store
959 	 * its ID in dpr->dpr_tid.
960 	 */
961 	if (nomonitor || (flags & PGRAB_RDONLY)) {
962 		if (dph->dph_lrucnt >= dph->dph_lrulim) {
963 			for (opr = dt_list_prev(&dph->dph_lrulist);
964 			    opr != NULL; opr = dt_list_prev(opr)) {
965 				if (opr->dpr_cacheable && opr->dpr_refs == 0) {
966 					dt_proc_destroy(dtp, opr->dpr_proc);
967 					break;
968 				}
969 			}
970 		}
971 
972 		if (flags & PGRAB_RDONLY) {
973 			dpr->dpr_cacheable = B_TRUE;
974 			dpr->dpr_rdonly = B_TRUE;
975 			dph->dph_lrucnt++;
976 		}
977 
978 	} else if (dt_proc_create_thread(dtp, dpr, DT_PROC_STOP_GRAB) != 0)
979 		return (NULL); /* dt_proc_error() has been called for us */
980 
981 	dpr->dpr_hash = dph->dph_hash[h];
982 	dph->dph_hash[h] = dpr;
983 	dt_list_prepend(&dph->dph_lrulist, dpr);
984 
985 	dt_dprintf("grabbed pid %d\n", (int)pid);
986 	dpr->dpr_refs++;
987 
988 	return (dpr->dpr_proc);
989 }
990 
991 void
992 dt_proc_release(dtrace_hdl_t *dtp, struct ps_prochandle *P)
993 {
994 	dt_proc_t *dpr = dt_proc_lookup(dtp, P, B_FALSE);
995 	dt_proc_hash_t *dph = dtp->dt_procs;
996 
997 	assert(dpr != NULL);
998 	assert(dpr->dpr_refs != 0);
999 
1000 	if (--dpr->dpr_refs == 0 &&
1001 	    (!dpr->dpr_cacheable || dph->dph_lrucnt > dph->dph_lrulim))
1002 		dt_proc_destroy(dtp, P);
1003 }
1004 
1005 void
1006 dt_proc_continue(dtrace_hdl_t *dtp, struct ps_prochandle *P)
1007 {
1008 	dt_proc_t *dpr = dt_proc_lookup(dtp, P, B_FALSE);
1009 
1010 	(void) pthread_mutex_lock(&dpr->dpr_lock);
1011 
1012 	if (dpr->dpr_stop & DT_PROC_STOP_IDLE) {
1013 		dpr->dpr_stop &= ~DT_PROC_STOP_IDLE;
1014 		(void) pthread_cond_broadcast(&dpr->dpr_cv);
1015 	}
1016 
1017 	(void) pthread_mutex_unlock(&dpr->dpr_lock);
1018 }
1019 
1020 void
1021 dt_proc_lock(dtrace_hdl_t *dtp, struct ps_prochandle *P)
1022 {
1023 	dt_proc_t *dpr = dt_proc_lookup(dtp, P, B_FALSE);
1024 	int err = pthread_mutex_lock(&dpr->dpr_lock);
1025 	assert(err == 0); /* check for recursion */
1026 }
1027 
1028 void
1029 dt_proc_unlock(dtrace_hdl_t *dtp, struct ps_prochandle *P)
1030 {
1031 	dt_proc_t *dpr = dt_proc_lookup(dtp, P, B_FALSE);
1032 	int err = pthread_mutex_unlock(&dpr->dpr_lock);
1033 	assert(err == 0); /* check for unheld lock */
1034 }
1035 
1036 void
1037 dt_proc_hash_create(dtrace_hdl_t *dtp)
1038 {
1039 	if ((dtp->dt_procs = dt_zalloc(dtp, sizeof (dt_proc_hash_t) +
1040 	    sizeof (dt_proc_t *) * _dtrace_pidbuckets - 1)) != NULL) {
1041 
1042 		(void) pthread_mutex_init(&dtp->dt_procs->dph_lock, NULL);
1043 		(void) pthread_cond_init(&dtp->dt_procs->dph_cv, NULL);
1044 
1045 		dtp->dt_procs->dph_hashlen = _dtrace_pidbuckets;
1046 		dtp->dt_procs->dph_lrulim = _dtrace_pidlrulim;
1047 	}
1048 }
1049 
1050 void
1051 dt_proc_hash_destroy(dtrace_hdl_t *dtp)
1052 {
1053 	dt_proc_hash_t *dph = dtp->dt_procs;
1054 	dt_proc_t *dpr;
1055 
1056 	while ((dpr = dt_list_next(&dph->dph_lrulist)) != NULL)
1057 		dt_proc_destroy(dtp, dpr->dpr_proc);
1058 
1059 	dtp->dt_procs = NULL;
1060 	dt_free(dtp, dph);
1061 }
1062 
1063 struct ps_prochandle *
1064 dtrace_proc_create(dtrace_hdl_t *dtp, const char *file, char *const *argv)
1065 {
1066 	dt_ident_t *idp = dt_idhash_lookup(dtp->dt_macros, "target");
1067 	struct ps_prochandle *P = dt_proc_create(dtp, file, argv);
1068 
1069 	if (P != NULL && idp != NULL && idp->di_id == 0)
1070 		idp->di_id = Pstatus(P)->pr_pid; /* $target = created pid */
1071 
1072 	return (P);
1073 }
1074 
1075 struct ps_prochandle *
1076 dtrace_proc_grab(dtrace_hdl_t *dtp, pid_t pid, int flags)
1077 {
1078 	dt_ident_t *idp = dt_idhash_lookup(dtp->dt_macros, "target");
1079 	struct ps_prochandle *P = dt_proc_grab(dtp, pid, flags, 0);
1080 
1081 	if (P != NULL && idp != NULL && idp->di_id == 0)
1082 		idp->di_id = pid; /* $target = grabbed pid */
1083 
1084 	return (P);
1085 }
1086 
1087 void
1088 dtrace_proc_release(dtrace_hdl_t *dtp, struct ps_prochandle *P)
1089 {
1090 	dt_proc_release(dtp, P);
1091 }
1092 
1093 void
1094 dtrace_proc_continue(dtrace_hdl_t *dtp, struct ps_prochandle *P)
1095 {
1096 	dt_proc_continue(dtp, P);
1097 }
1098