/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Copyright (c) 2014, Joyent, Inc. All rights reserved.
 * Copyright 2023 Oxide Computer Company
 */

#include <stdio.h>
#include <stdlib.h>
#include <stddef.h>
#include <unistd.h>
#include <thr_uberdata.h>
#include <thread_db.h>
#include <libc_int.h>

/*
 * Private structures.
 */

typedef union {
        mutex_t         lock;
        rwlock_t        rwlock;
        sema_t          semaphore;
        cond_t          condition;
} td_so_un_t;

struct td_thragent {
        rwlock_t        rwlock;
        struct ps_prochandle *ph_p;
        int             initialized;
        int             sync_tracking;
        int             model;
        int             primary_map;
        psaddr_t        bootstrap_addr;
        psaddr_t        uberdata_addr;
        psaddr_t        tdb_eventmask_addr;
        psaddr_t        tdb_register_sync_addr;
        psaddr_t        tdb_events[TD_MAX_EVENT_NUM - TD_MIN_EVENT_NUM + 1];
        psaddr_t        hash_table_addr;
        int             hash_size;
        lwpid_t         single_lwpid;
        psaddr_t        single_ulwp_addr;
};

/*
 * This is the name of the variable in libc that contains
 * the uberdata address that we will need.
 */
#define TD_BOOTSTRAP_NAME       "_tdb_bootstrap"
/*
 * This is the actual name of uberdata, used in the event
 * that tdb_bootstrap has not yet been initialized.
 */
#define TD_UBERDATA_NAME        "_uberdata"
/*
 * The library name should end with ".so.1", but older versions of
 * dbx expect the unadorned name and malfunction if ".1" is specified.
 * Unfortunately, if ".1" is not specified, mdb malfunctions when it
 * is applied to another instance of itself (due to the presence of
 * /usr/lib/mdb/proc/libc.so).  So we try it both ways.
 */
#define TD_LIBRARY_NAME         "libc.so"
#define TD_LIBRARY_NAME_1       "libc.so.1"

td_err_e __td_thr_get_info(td_thrhandle_t *th_p, td_thrinfo_t *ti_p);

td_err_e __td_ta_thr_iter(td_thragent_t *ta_p, td_thr_iter_f *cb,
        void *cbdata_p, td_thr_state_e state, int ti_pri,
        sigset_t *ti_sigmask_p, unsigned ti_user_flags);

/*
 * Initialize threads debugging interface.
 */
#pragma weak td_init = __td_init
td_err_e
__td_init()
{
        return (TD_OK);
}

/*
 * This function does nothing, and never did.
 * But the symbol is in the ABI, so we can't delete it.
 */
#pragma weak td_log = __td_log
void
__td_log()
{
}

/*
 * Short-cut to read just the hash table size from the process,
 * to avoid repeatedly reading the full uberdata structure when
 * dealing with a single-threaded process.
 */
static uint_t
td_read_hash_size(td_thragent_t *ta_p)
{
        psaddr_t addr;
        uint_t hash_size;

        switch (ta_p->initialized) {
        default:        /* uninitialized */
                return (0);
        case 1:         /* partially initialized */
                break;
        case 2:         /* fully initialized */
                return (ta_p->hash_size);
        }

        if (ta_p->model == PR_MODEL_NATIVE) {
                addr = ta_p->uberdata_addr + offsetof(uberdata_t, hash_size);
        } else {
#if defined(_LP64) && defined(_SYSCALL32)
                addr = ta_p->uberdata_addr + offsetof(uberdata32_t, hash_size);
#else
                addr = 0;
#endif
        }
        if (ps_pdread(ta_p->ph_p, addr, &hash_size, sizeof (hash_size))
            != PS_OK)
                return (0);
        return (hash_size);
}

static td_err_e
td_read_uberdata(td_thragent_t *ta_p)
{
        struct ps_prochandle *ph_p = ta_p->ph_p;
        int i;

        if (ta_p->model == PR_MODEL_NATIVE) {
                uberdata_t uberdata;

                if (ps_pdread(ph_p, ta_p->uberdata_addr,
                    &uberdata, sizeof (uberdata)) != PS_OK)
                        return (TD_DBERR);
                ta_p->primary_map = uberdata.primary_map;
                ta_p->tdb_eventmask_addr = ta_p->uberdata_addr +
                    offsetof(uberdata_t, tdb.tdb_ev_global_mask);
                ta_p->tdb_register_sync_addr = ta_p->uberdata_addr +
                    offsetof(uberdata_t, uberflags.uf_tdb_register_sync);
                ta_p->hash_table_addr = (psaddr_t)uberdata.thr_hash_table;
                ta_p->hash_size = uberdata.hash_size;
                if (ps_pdread(ph_p, (psaddr_t)uberdata.tdb.tdb_events,
                    ta_p->tdb_events, sizeof (ta_p->tdb_events)) != PS_OK)
                        return (TD_DBERR);
        } else {
#if defined(_LP64) && defined(_SYSCALL32)
                uberdata32_t uberdata;
                caddr32_t tdb_events[TD_MAX_EVENT_NUM - TD_MIN_EVENT_NUM + 1];

                if (ps_pdread(ph_p, ta_p->uberdata_addr,
                    &uberdata, sizeof (uberdata)) != PS_OK)
                        return (TD_DBERR);
                ta_p->primary_map = uberdata.primary_map;
                ta_p->tdb_eventmask_addr = ta_p->uberdata_addr +
                    offsetof(uberdata32_t, tdb.tdb_ev_global_mask);
                ta_p->tdb_register_sync_addr = ta_p->uberdata_addr +
                    offsetof(uberdata32_t, uberflags.uf_tdb_register_sync);
                ta_p->hash_table_addr = (psaddr_t)uberdata.thr_hash_table;
                ta_p->hash_size = uberdata.hash_size;
                if (ps_pdread(ph_p, (psaddr_t)uberdata.tdb.tdb_events,
                    tdb_events, sizeof (tdb_events)) != PS_OK)
                        return (TD_DBERR);
                for (i = 0; i < TD_MAX_EVENT_NUM - TD_MIN_EVENT_NUM + 1; i++)
                        ta_p->tdb_events[i] = tdb_events[i];
#else
                return (TD_DBERR);
#endif
        }

        /*
         * Unfortunately, we are (implicitly) assuming that our uberdata
         * definition precisely matches that of our target.  If this is not
         * true (that is, if we're examining a core file from a foreign
         * system that has a different definition of uberdata), the failure
         * modes can be frustratingly non-explicit.  In an effort to catch
         * this upon initialization (when the debugger may still be able to
         * opt for another thread model or may be able to fail explicitly), we
         * check that each of our tdb_events points to valid memory (these are
         * putatively text upon which a breakpoint can be issued), with the
         * hope that this is enough of a self-consistency check to lead to
         * explicit failure on a mismatch.
         */
        for (i = 0; i < TD_MAX_EVENT_NUM - TD_MIN_EVENT_NUM + 1; i++) {
                uint8_t check;

                if (ps_pdread(ph_p, (psaddr_t)ta_p->tdb_events[i],
                    &check, sizeof (check)) != PS_OK) {
                        return (TD_DBERR);
                }
        }

        if (ta_p->hash_size != 1) {     /* multi-threaded */
                ta_p->initialized = 2;
                ta_p->single_lwpid = 0;
                ta_p->single_ulwp_addr = 0;
        } else {                        /* single-threaded */
                ta_p->initialized = 1;
                /*
                 * Get the address and lwpid of the single thread/LWP.
                 * It may not be ulwp_one if this is a child of fork1().
                 */
                if (ta_p->model == PR_MODEL_NATIVE) {
                        thr_hash_table_t head;
                        lwpid_t lwpid = 0;

                        if (ps_pdread(ph_p, ta_p->hash_table_addr,
                            &head, sizeof (head)) != PS_OK)
                                return (TD_DBERR);
                        if ((psaddr_t)head.hash_bucket == 0)
                                ta_p->initialized = 0;
                        else if (ps_pdread(ph_p, (psaddr_t)head.hash_bucket +
                            offsetof(ulwp_t, ul_lwpid),
                            &lwpid, sizeof (lwpid)) != PS_OK)
                                return (TD_DBERR);
                        ta_p->single_lwpid = lwpid;
                        ta_p->single_ulwp_addr = (psaddr_t)head.hash_bucket;
                } else {
#if defined(_LP64) && defined(_SYSCALL32)
                        thr_hash_table32_t head;
                        lwpid_t lwpid = 0;

                        if (ps_pdread(ph_p, ta_p->hash_table_addr,
                            &head, sizeof (head)) != PS_OK)
                                return (TD_DBERR);
                        if ((psaddr_t)head.hash_bucket == 0)
                                ta_p->initialized = 0;
                        else if (ps_pdread(ph_p, (psaddr_t)head.hash_bucket +
                            offsetof(ulwp32_t, ul_lwpid),
                            &lwpid, sizeof (lwpid)) != PS_OK)
                                return (TD_DBERR);
                        ta_p->single_lwpid = lwpid;
                        ta_p->single_ulwp_addr = (psaddr_t)head.hash_bucket;
#else
                        return (TD_DBERR);
#endif
                }
        }
        if (!ta_p->primary_map)
                ta_p->initialized = 0;
        return (TD_OK);
}

static td_err_e
td_read_bootstrap_data(td_thragent_t *ta_p)
{
        struct ps_prochandle *ph_p = ta_p->ph_p;
        psaddr_t bootstrap_addr;
        psaddr_t uberdata_addr;
        ps_err_e db_return;
        td_err_e return_val;
        int do_1;

        switch (ta_p->initialized) {
        case 2:                 /* fully initialized */
                return (TD_OK);
        case 1:                 /* partially initialized */
                if (td_read_hash_size(ta_p) == 1)
                        return (TD_OK);
                return (td_read_uberdata(ta_p));
        }

        /*
         * Uninitialized -- do the startup work.
         * We set ta_p->initialized to -1 to cut off recursive calls
         * into libc_db by code in the provider of ps_pglobal_lookup().
         */
        do_1 = 0;
        ta_p->initialized = -1;
        db_return = ps_pglobal_lookup(ph_p, TD_LIBRARY_NAME,
            TD_BOOTSTRAP_NAME, &bootstrap_addr);
        if (db_return == PS_NOSYM) {
                do_1 = 1;
                db_return = ps_pglobal_lookup(ph_p, TD_LIBRARY_NAME_1,
                    TD_BOOTSTRAP_NAME, &bootstrap_addr);
        }
        if (db_return == PS_NOSYM)      /* libc is not linked yet */
                return (TD_NOLIBTHREAD);
        if (db_return != PS_OK)
                return (TD_ERR);
        db_return = ps_pglobal_lookup(ph_p,
            do_1? TD_LIBRARY_NAME_1 : TD_LIBRARY_NAME,
            TD_UBERDATA_NAME, &uberdata_addr);
        if (db_return == PS_NOSYM)      /* libc is not linked yet */
                return (TD_NOLIBTHREAD);
        if (db_return != PS_OK)
                return (TD_ERR);

        /*
         * Read the uberdata address into the thread agent structure.
         */
        if (ta_p->model == PR_MODEL_NATIVE) {
                psaddr_t psaddr;
                if (ps_pdread(ph_p, bootstrap_addr,
                    &psaddr, sizeof (psaddr)) != PS_OK)
                        return (TD_DBERR);
                if ((ta_p->bootstrap_addr = psaddr) == 0)
                        psaddr = uberdata_addr;
                else if (ps_pdread(ph_p, psaddr,
                    &psaddr, sizeof (psaddr)) != PS_OK)
                        return (TD_DBERR);
                if (psaddr == 0) {
                        /* primary linkmap in the tgt is not initialized */
                        ta_p->bootstrap_addr = 0;
                        psaddr = uberdata_addr;
                }
                ta_p->uberdata_addr = psaddr;
        } else {
#if defined(_LP64) && defined(_SYSCALL32)
                caddr32_t psaddr;
                if (ps_pdread(ph_p, bootstrap_addr,
                    &psaddr, sizeof (psaddr)) != PS_OK)
                        return (TD_DBERR);
                if ((ta_p->bootstrap_addr = (psaddr_t)psaddr) == 0)
                        psaddr = (caddr32_t)uberdata_addr;
                else if (ps_pdread(ph_p, (psaddr_t)psaddr,
                    &psaddr, sizeof (psaddr)) != PS_OK)
                        return (TD_DBERR);
                if (psaddr == 0) {
                        /* primary linkmap in the tgt is not initialized */
                        ta_p->bootstrap_addr = 0;
                        psaddr = (caddr32_t)uberdata_addr;
                }
                ta_p->uberdata_addr = (psaddr_t)psaddr;
#else
                return (TD_DBERR);
#endif  /* _SYSCALL32 */
        }

        if ((return_val = td_read_uberdata(ta_p)) != TD_OK)
                return (return_val);
        if (ta_p->bootstrap_addr == 0)
                ta_p->initialized = 0;
        return (TD_OK);
}

#pragma weak ps_kill
#pragma weak ps_lrolltoaddr

/*
 * Allocate a new agent process handle ("thread agent").
 */
#pragma weak td_ta_new = __td_ta_new
td_err_e
__td_ta_new(struct ps_prochandle *ph_p, td_thragent_t **ta_pp)
{
        td_thragent_t *ta_p;
        int model;
        td_err_e return_val = TD_OK;

        if (ph_p == NULL)
                return (TD_BADPH);
        if (ta_pp == NULL)
                return (TD_ERR);
        *ta_pp = NULL;
        if (ps_pstop(ph_p) != PS_OK)
                return (TD_DBERR);
        /*
         * ps_pdmodel might not be defined if this is an older client.
         * Make it a weak symbol and test if it exists before calling.
         */
#pragma weak ps_pdmodel
        if (ps_pdmodel == NULL) {
                model = PR_MODEL_NATIVE;
        } else if (ps_pdmodel(ph_p, &model) != PS_OK) {
                (void) ps_pcontinue(ph_p);
                return (TD_ERR);
        }
        if ((ta_p = malloc(sizeof (*ta_p))) == NULL) {
                (void) ps_pcontinue(ph_p);
                return (TD_MALLOC);
        }

        /*
         * Initialize the agent process handle.
         * Pick up the symbol value we need from the target process.
         */
        (void) memset(ta_p, 0, sizeof (*ta_p));
        ta_p->ph_p = ph_p;
        (void) rwlock_init(&ta_p->rwlock, USYNC_THREAD, NULL);
        ta_p->model = model;
        return_val = td_read_bootstrap_data(ta_p);

        /*
         * Because the old libthread_db enabled lock tracking by default,
         * we must also do it.  However, we do it only if the application
         * provides the ps_kill() and ps_lrolltoaddr() interfaces.
         * (dbx provides the ps_kill() and ps_lrolltoaddr() interfaces.)
         */
        if (return_val == TD_OK && ps_kill != NULL && ps_lrolltoaddr != NULL) {
                register_sync_t oldenable;
                register_sync_t enable = REGISTER_SYNC_ENABLE;
                psaddr_t psaddr = ta_p->tdb_register_sync_addr;

                if (ps_pdread(ph_p, psaddr,
                    &oldenable, sizeof (oldenable)) != PS_OK)
                        return_val = TD_DBERR;
                else if (oldenable != REGISTER_SYNC_OFF ||
                    ps_pdwrite(ph_p, psaddr,
                    &enable, sizeof (enable)) != PS_OK) {
                        /*
                         * Lock tracking was already enabled or we
                         * failed to enable it, probably because we
                         * are examining a core file.  In either case
                         * set the sync_tracking flag non-zero to
                         * indicate that we should not attempt to
                         * disable lock tracking when we delete the
                         * agent process handle in td_ta_delete().
                         */
                        ta_p->sync_tracking = 1;
                }
        }

        if (return_val == TD_OK)
                *ta_pp = ta_p;
        else
                free(ta_p);

        (void) ps_pcontinue(ph_p);
        return (return_val);
}

/*
 * Utility function to grab the readers lock and return the prochandle,
 * given an agent process handle.  Performs standard error checking.
 * Returns non-NULL with the lock held, or NULL with the lock not held.
 */
static struct ps_prochandle *
ph_lock_ta(td_thragent_t *ta_p, td_err_e *err)
{
        struct ps_prochandle *ph_p = NULL;
        td_err_e error;

        if (ta_p == NULL || ta_p->initialized == -1) {
                *err = TD_BADTA;
        } else if (rw_rdlock(&ta_p->rwlock) != 0) {     /* can't happen? */
                *err = TD_BADTA;
        } else if ((ph_p = ta_p->ph_p) == NULL) {
                (void) rw_unlock(&ta_p->rwlock);
                *err = TD_BADPH;
        } else if (ta_p->initialized != 2 &&
            (error = td_read_bootstrap_data(ta_p)) != TD_OK) {
                (void) rw_unlock(&ta_p->rwlock);
                ph_p = NULL;
                *err = error;
        } else {
                *err = TD_OK;
        }

        return (ph_p);
}

/*
 * Utility function to grab the readers lock and return the prochandle,
 * given an agent thread handle.  Performs standard error checking.
 * Returns non-NULL with the lock held, or NULL with the lock not held.
 */
static struct ps_prochandle *
ph_lock_th(const td_thrhandle_t *th_p, td_err_e *err)
{
        if (th_p == NULL || th_p->th_unique == 0) {
                *err = TD_BADTH;
                return (NULL);
        }
        return (ph_lock_ta(th_p->th_ta_p, err));
}

/*
 * Utility function to grab the readers lock and return the prochandle,
 * given a synchronization object handle.  Performs standard error checking.
 * Returns non-NULL with the lock held, or NULL with the lock not held.
 */
static struct ps_prochandle *
ph_lock_sh(const td_synchandle_t *sh_p, td_err_e *err)
{
        if (sh_p == NULL || sh_p->sh_unique == 0) {
                *err = TD_BADSH;
                return (NULL);
        }
        return (ph_lock_ta(sh_p->sh_ta_p, err));
}

/*
 * Unlock the agent process handle obtained from ph_lock_*().
 */
static void
ph_unlock(td_thragent_t *ta_p)
{
        (void) rw_unlock(&ta_p->rwlock);
}

/*
 * De-allocate an agent process handle,
 * releasing all related resources.
 *
 * XXX -- This is hopelessly broken ---
 * Storage for thread agent is not deallocated.  The prochandle
 * in the thread agent is set to NULL so that future uses of
 * the thread agent can be detected and an error value returned.
 * All functions in the external user interface that make
 * use of the thread agent are expected
 * to check for a NULL prochandle in the thread agent.
 * All such functions are also expected to obtain a
 * reader lock on the thread agent while it is using it.
 */
#pragma weak td_ta_delete = __td_ta_delete
td_err_e
__td_ta_delete(td_thragent_t *ta_p)
{
        struct ps_prochandle *ph_p;

        /*
         * This is the only place we grab the writer lock.
         * We are going to NULL out the prochandle.
         */
        if (ta_p == NULL || rw_wrlock(&ta_p->rwlock) != 0)
                return (TD_BADTA);
        if ((ph_p = ta_p->ph_p) == NULL) {
                (void) rw_unlock(&ta_p->rwlock);
                return (TD_BADPH);
        }
        /*
         * If synch. tracking was disabled when td_ta_new() was called and
         * if td_ta_sync_tracking_enable() was never called, then disable
         * synch. tracking (it was enabled by default in td_ta_new()).
         */
        if (ta_p->sync_tracking == 0 &&
            ps_kill != NULL && ps_lrolltoaddr != NULL) {
                register_sync_t enable = REGISTER_SYNC_DISABLE;

                (void) ps_pdwrite(ph_p, ta_p->tdb_register_sync_addr,
                    &enable, sizeof (enable));
        }
        ta_p->ph_p = NULL;
        (void) rw_unlock(&ta_p->rwlock);
        return (TD_OK);
}

/*
 * Map an agent process handle to a client prochandle.
 * Currently unused by dbx.
 */
#pragma weak td_ta_get_ph = __td_ta_get_ph
td_err_e
__td_ta_get_ph(td_thragent_t *ta_p, struct ps_prochandle **ph_pp)
{
        td_err_e return_val;

        if (ph_pp != NULL)      /* protect stupid callers */
                *ph_pp = NULL;
        if (ph_pp == NULL)
                return (TD_ERR);
        if ((*ph_pp = ph_lock_ta(ta_p, &return_val)) == NULL)
                return (return_val);
        ph_unlock(ta_p);
        return (TD_OK);
}

/*
 * Set the process's suggested concurrency level.
 * This is a no-op in a one-level model.
 * Currently unused by dbx.
 */
#pragma weak td_ta_setconcurrency = __td_ta_setconcurrency
/* ARGSUSED1 */
td_err_e
__td_ta_setconcurrency(const td_thragent_t *ta_p, int level)
{
        if (ta_p == NULL)
                return (TD_BADTA);
        if (ta_p->ph_p == NULL)
                return (TD_BADPH);
        return (TD_OK);
}

/*
 * Get the number of threads in the process.
 */
#pragma weak td_ta_get_nthreads = __td_ta_get_nthreads
td_err_e
__td_ta_get_nthreads(td_thragent_t *ta_p, int *nthread_p)
{
        struct ps_prochandle *ph_p;
        td_err_e return_val;
        int nthreads;
        int nzombies;
        psaddr_t nthreads_addr;
        psaddr_t nzombies_addr;

        if (ta_p->model == PR_MODEL_NATIVE) {
                nthreads_addr = ta_p->uberdata_addr +
                    offsetof(uberdata_t, nthreads);
                nzombies_addr = ta_p->uberdata_addr +
                    offsetof(uberdata_t, nzombies);
        } else {
#if defined(_LP64) && defined(_SYSCALL32)
                nthreads_addr = ta_p->uberdata_addr +
                    offsetof(uberdata32_t, nthreads);
                nzombies_addr = ta_p->uberdata_addr +
                    offsetof(uberdata32_t, nzombies);
#else
                nthreads_addr = 0;
                nzombies_addr = 0;
#endif  /* _SYSCALL32 */
        }

        if (nthread_p == NULL)
                return (TD_ERR);
        if ((ph_p = ph_lock_ta(ta_p, &return_val)) == NULL)
                return (return_val);
        if (ps_pdread(ph_p, nthreads_addr, &nthreads, sizeof (int)) != PS_OK)
                return_val = TD_DBERR;
        if (ps_pdread(ph_p, nzombies_addr, &nzombies, sizeof (int)) != PS_OK)
                return_val = TD_DBERR;
        ph_unlock(ta_p);
        if (return_val == TD_OK)
                *nthread_p = nthreads + nzombies;
        return (return_val);
}

typedef struct {
        thread_t        tid;
        int             found;
        td_thrhandle_t  th;
} td_mapper_param_t;

/*
 * Check the value in data against the thread id.
 * If it matches, return 1 to terminate iterations.
 * This function is used by td_ta_map_id2thr() to map a tid to a thread handle.
 */
static int
td_mapper_id2thr(td_thrhandle_t *th_p, td_mapper_param_t *data)
{
        td_thrinfo_t ti;

        if (__td_thr_get_info(th_p, &ti) == TD_OK &&
            data->tid == ti.ti_tid) {
                data->found = 1;
                data->th = *th_p;
                return (1);
        }
        return (0);
}

/*
 * Given a thread identifier, return the corresponding thread handle.
 */
#pragma weak td_ta_map_id2thr = __td_ta_map_id2thr
td_err_e
__td_ta_map_id2thr(td_thragent_t *ta_p, thread_t tid,
    td_thrhandle_t *th_p)
{
        td_err_e                return_val;
        td_mapper_param_t       data;

        if (th_p != NULL &&     /* optimize for a single thread */
            ta_p != NULL &&
            ta_p->initialized == 1 &&
            (td_read_hash_size(ta_p) == 1 ||
            td_read_uberdata(ta_p) == TD_OK) &&
            ta_p->initialized == 1 &&
            ta_p->single_lwpid == tid) {
                th_p->th_ta_p = ta_p;
                if ((th_p->th_unique = ta_p->single_ulwp_addr) == 0)
                        return (TD_NOTHR);
                return (TD_OK);
        }

        /*
         * LOCKING EXCEPTION - Locking is not required here because
         * the locking and checking will be done in __td_ta_thr_iter.
         */

        if (ta_p == NULL)
                return (TD_BADTA);
        if (th_p == NULL)
                return (TD_BADTH);
        if (tid == 0)
                return (TD_NOTHR);

        data.tid = tid;
        data.found = 0;
        return_val = __td_ta_thr_iter(ta_p,
            (td_thr_iter_f *)td_mapper_id2thr, (void *)&data,
            TD_THR_ANY_STATE, TD_THR_LOWEST_PRIORITY,
            TD_SIGNO_MASK, TD_THR_ANY_USER_FLAGS);
        if (return_val == TD_OK) {
                if (data.found == 0)
                        return_val = TD_NOTHR;
                else
                        *th_p = data.th;
        }

        return (return_val);
}

/*
 * Map the address of a synchronization object to a sync. object handle.
 */
#pragma weak td_ta_map_addr2sync = __td_ta_map_addr2sync
td_err_e
__td_ta_map_addr2sync(td_thragent_t *ta_p, psaddr_t addr, td_synchandle_t *sh_p)
{
        struct ps_prochandle *ph_p;
        td_err_e return_val;
        uint16_t sync_magic;

        if (sh_p == NULL)
                return (TD_BADSH);
        if (addr == 0)
                return (TD_ERR);
        if ((ph_p = ph_lock_ta(ta_p, &return_val)) == NULL)
                return (return_val);
        /*
         * Check the magic number of the sync. object to make sure it's valid.
         * The magic number is at the same offset for all sync. objects.
         */
        if (ps_pdread(ph_p, (psaddr_t)&((mutex_t *)addr)->mutex_magic,
            &sync_magic, sizeof (sync_magic)) != PS_OK) {
                ph_unlock(ta_p);
                return (TD_BADSH);
        }
        ph_unlock(ta_p);
        if (sync_magic != MUTEX_MAGIC && sync_magic != COND_MAGIC &&
            sync_magic != SEMA_MAGIC && sync_magic != RWL_MAGIC)
                return (TD_BADSH);
        /*
         * Just fill in the appropriate fields of the sync. handle.
         */
        sh_p->sh_ta_p = (td_thragent_t *)ta_p;
        sh_p->sh_unique = addr;
        return (TD_OK);
}

/*
 * Iterate over the set of global TSD keys.
 * The call back function is called with three arguments,
 * a key, a pointer to the destructor function, and the cbdata pointer.
 * Currently unused by dbx.
 */
#pragma weak td_ta_tsd_iter = __td_ta_tsd_iter
td_err_e
__td_ta_tsd_iter(td_thragent_t *ta_p, td_key_iter_f *cb, void *cbdata_p)
{
        struct ps_prochandle *ph_p;
        td_err_e        return_val;
        int             key;
        int             numkeys;
        psaddr_t        dest_addr;
        psaddr_t        *destructors = NULL;
        PFrV            destructor;

        if (cb == NULL)
                return (TD_ERR);
        if ((ph_p = ph_lock_ta(ta_p, &return_val)) == NULL)
                return (return_val);
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(ta_p);
                return (TD_DBERR);
        }

        if (ta_p->model == PR_MODEL_NATIVE) {
                tsd_metadata_t tsdm;

                if (ps_pdread(ph_p,
                    ta_p->uberdata_addr + offsetof(uberdata_t, tsd_metadata),
                    &tsdm, sizeof (tsdm)) != PS_OK)
                        return_val = TD_DBERR;
                else {
                        numkeys = tsdm.tsdm_nused;
                        dest_addr = (psaddr_t)tsdm.tsdm_destro;
                        if (numkeys > 0)
                                destructors =
                                    malloc(numkeys * sizeof (psaddr_t));
                }
        } else {
#if defined(_LP64) && defined(_SYSCALL32)
                tsd_metadata32_t tsdm;

                if (ps_pdread(ph_p,
                    ta_p->uberdata_addr + offsetof(uberdata32_t, tsd_metadata),
                    &tsdm, sizeof (tsdm)) != PS_OK)
                        return_val = TD_DBERR;
                else {
                        numkeys = tsdm.tsdm_nused;
                        dest_addr = (psaddr_t)tsdm.tsdm_destro;
                        if (numkeys > 0)
                                destructors =
                                    malloc(numkeys * sizeof (caddr32_t));
                }
#else
                return_val = TD_DBERR;
#endif  /* _SYSCALL32 */
        }

        if (return_val != TD_OK || numkeys <= 0) {
                (void) ps_pcontinue(ph_p);
                ph_unlock(ta_p);
                return (return_val);
        }

        if (destructors == NULL)
                return_val = TD_MALLOC;
        else if (ta_p->model == PR_MODEL_NATIVE) {
                if (ps_pdread(ph_p, dest_addr,
                    destructors, numkeys * sizeof (psaddr_t)) != PS_OK)
                        return_val = TD_DBERR;
                else {
                        for (key = 1; key < numkeys; key++) {
                                destructor = (PFrV)destructors[key];
                                if (destructor != TSD_UNALLOCATED &&
                                    (*cb)(key, destructor, cbdata_p))
                                        break;
                        }
                }
#if defined(_LP64) && defined(_SYSCALL32)
        } else {
                caddr32_t *destructors32 = (caddr32_t *)destructors;
                caddr32_t destruct32;

                if (ps_pdread(ph_p, dest_addr,
                    destructors32, numkeys * sizeof (caddr32_t)) != PS_OK)
                        return_val = TD_DBERR;
                else {
                        for (key = 1; key < numkeys; key++) {
                                destruct32 = destructors32[key];
                                if ((destruct32 !=
                                    (caddr32_t)(uintptr_t)TSD_UNALLOCATED) &&
                                    (*cb)(key, (PFrV)(uintptr_t)destruct32,
                                    cbdata_p))
                                        break;
                        }
                }
#endif  /* _SYSCALL32 */
        }

        if (destructors)
                free(destructors);
        (void) ps_pcontinue(ph_p);
        ph_unlock(ta_p);
        return (return_val);
}

int
sigequalset(const sigset_t *s1, const sigset_t *s2)
{
        return (
            s1->__sigbits[0] == s2->__sigbits[0] &&
            s1->__sigbits[1] == s2->__sigbits[1] &&
            s1->__sigbits[2] == s2->__sigbits[2] &&
            s1->__sigbits[3] == s2->__sigbits[3]);
}

/*
 * Description:
 *   Iterate over all threads. For each thread call
 * the function pointed to by "cb" with a pointer
 * to a thread handle, and a pointer to data which
 * can be NULL. Only call td_thr_iter_f() on threads
 * which match the properties of state, ti_pri,
 * ti_sigmask_p, and ti_user_flags.  If cb returns
 * a non-zero value, terminate iterations.
 *
 * Input:
 *   *ta_p - thread agent
 *   *cb - call back function defined by user.
 * td_thr_iter_f() takes a thread handle and
 * cbdata_p as a parameter.
 *   cbdata_p - parameter for td_thr_iter_f().
 *
 *   state - state of threads of interest.  A value of
 * TD_THR_ANY_STATE from enum td_thr_state_e
 * does not restrict iterations by state.
 *   ti_pri - lower bound of priorities of threads of
 * interest.  A value of TD_THR_LOWEST_PRIORITY
 * defined in thread_db.h does not restrict
 * iterations by priority.  A thread with priority
 * less than ti_pri will NOT be passed to the callback
 * function.
 *   ti_sigmask_p - signal mask of threads of interest.
 * A value of TD_SIGNO_MASK defined in thread_db.h
 * does not restrict iterations by signal mask.
 *   ti_user_flags - user flags of threads of interest.  A
 * value of TD_THR_ANY_USER_FLAGS defined in thread_db.h
 * does not restrict iterations by user flags.
 */
#pragma weak td_ta_thr_iter = __td_ta_thr_iter
td_err_e
__td_ta_thr_iter(td_thragent_t *ta_p, td_thr_iter_f *cb,
    void *cbdata_p, td_thr_state_e state, int ti_pri,
    sigset_t *ti_sigmask_p, unsigned ti_user_flags)
{
        struct ps_prochandle *ph_p;
        psaddr_t        first_lwp_addr;
        psaddr_t        first_zombie_addr;
        psaddr_t        curr_lwp_addr;
        psaddr_t        next_lwp_addr;
        td_thrhandle_t  th;
        ps_err_e        db_return;
        ps_err_e        db_return2;
        td_err_e        return_val;

        if (cb == NULL)
                return (TD_ERR);
        /*
         * If state is not within bound, short circuit.
         */
        if (state < TD_THR_ANY_STATE || state > TD_THR_STOPPED_ASLEEP)
                return (TD_OK);

        if ((ph_p = ph_lock_ta(ta_p, &return_val)) == NULL)
                return (return_val);
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(ta_p);
                return (TD_DBERR);
        }

        /*
         * For each ulwp_t in the circular linked lists pointed
         * to by "all_lwps" and "all_zombies":
         * (1) Filter each thread.
         * (2) Create the thread_object for each thread that passes.
         * (3) Call the call back function on each thread.
         */

        if (ta_p->model == PR_MODEL_NATIVE) {
                db_return = ps_pdread(ph_p,
                    ta_p->uberdata_addr + offsetof(uberdata_t, all_lwps),
                    &first_lwp_addr, sizeof (first_lwp_addr));
                db_return2 = ps_pdread(ph_p,
                    ta_p->uberdata_addr + offsetof(uberdata_t, all_zombies),
                    &first_zombie_addr, sizeof (first_zombie_addr));
        } else {
#if defined(_LP64) && defined(_SYSCALL32)
                caddr32_t addr32;

                db_return = ps_pdread(ph_p,
                    ta_p->uberdata_addr + offsetof(uberdata32_t, all_lwps),
                    &addr32, sizeof (addr32));
                first_lwp_addr = addr32;
                db_return2 = ps_pdread(ph_p,
                    ta_p->uberdata_addr + offsetof(uberdata32_t, all_zombies),
                    &addr32, sizeof (addr32));
                first_zombie_addr = addr32;
#else   /* _SYSCALL32 */
                db_return = PS_ERR;
                db_return2 = PS_ERR;
#endif  /* _SYSCALL32 */
        }
        if (db_return == PS_OK)
                db_return = db_return2;

        /*
         * If first_lwp_addr and first_zombie_addr are both NULL,
         * libc must not yet be initialized or all threads have
         * exited.  Return TD_NOTHR and all will be well.
         */
        if (db_return == PS_OK &&
            first_lwp_addr == 0 && first_zombie_addr == 0) {
                (void) ps_pcontinue(ph_p);
                ph_unlock(ta_p);
                return (TD_NOTHR);
        }
        if (db_return != PS_OK) {
                (void) ps_pcontinue(ph_p);
                ph_unlock(ta_p);
                return (TD_DBERR);
        }

        /*
         * Run down the lists of all living and dead lwps.
         */
        if (first_lwp_addr == 0)
                first_lwp_addr = first_zombie_addr;
        curr_lwp_addr = first_lwp_addr;
        for (;;) {
                td_thr_state_e ts_state;
                int userpri;
                unsigned userflags;
                sigset_t mask;

                /*
                 * Read the ulwp struct.
                 */
                if (ta_p->model == PR_MODEL_NATIVE) {
                        ulwp_t ulwp;

                        if (ps_pdread(ph_p, curr_lwp_addr,
                            &ulwp, sizeof (ulwp)) != PS_OK &&
                            ((void) memset(&ulwp, 0, sizeof (ulwp)),
                            ps_pdread(ph_p, curr_lwp_addr,
                            &ulwp, REPLACEMENT_SIZE)) != PS_OK) {
                                return_val = TD_DBERR;
                                break;
                        }
                        next_lwp_addr = (psaddr_t)ulwp.ul_forw;

                        ts_state = ulwp.ul_dead? TD_THR_ZOMBIE :
                            ulwp.ul_stop? TD_THR_STOPPED :
                            ulwp.ul_wchan? TD_THR_SLEEP :
                            TD_THR_ACTIVE;
                        userpri = ulwp.ul_pri;
                        userflags = ulwp.ul_usropts;
                        if (ulwp.ul_dead)
                                (void) sigemptyset(&mask);
                        else
                                mask = *(sigset_t *)&ulwp.ul_sigmask;
                } else {
#if defined(_LP64) && defined(_SYSCALL32)
                        ulwp32_t ulwp;

                        if (ps_pdread(ph_p, curr_lwp_addr,
                            &ulwp, sizeof (ulwp)) != PS_OK &&
                            ((void) memset(&ulwp, 0, sizeof (ulwp)),
                            ps_pdread(ph_p, curr_lwp_addr,
                            &ulwp, REPLACEMENT_SIZE32)) != PS_OK) {
                                return_val = TD_DBERR;
                                break;
                        }
                        next_lwp_addr = (psaddr_t)ulwp.ul_forw;

                        ts_state = ulwp.ul_dead? TD_THR_ZOMBIE :
                            ulwp.ul_stop? TD_THR_STOPPED :
                            ulwp.ul_wchan? TD_THR_SLEEP :
                            TD_THR_ACTIVE;
                        userpri = ulwp.ul_pri;
                        userflags = ulwp.ul_usropts;
                        if (ulwp.ul_dead)
                                (void) sigemptyset(&mask);
                        else
                                mask = *(sigset_t *)&ulwp.ul_sigmask;
#else   /* _SYSCALL32 */
                        return_val = TD_ERR;
                        break;
#endif  /* _SYSCALL32 */
                }

                /*
                 * Filter on state, priority, sigmask, and user flags.
                 */

                if ((state != ts_state) &&
                    (state != TD_THR_ANY_STATE))
                        goto advance;

                if (ti_pri > userpri)
                        goto advance;

                if (ti_sigmask_p != TD_SIGNO_MASK &&
                    !sigequalset(ti_sigmask_p, &mask))
                        goto advance;

                if (ti_user_flags != userflags &&
                    ti_user_flags != (unsigned)TD_THR_ANY_USER_FLAGS)
                        goto advance;

                /*
                 * Call back - break if the return
                 * from the call back is non-zero.
                 */
                th.th_ta_p = (td_thragent_t *)ta_p;
                th.th_unique = curr_lwp_addr;
                if ((*cb)(&th, cbdata_p))
                        break;

advance:
                if ((curr_lwp_addr = next_lwp_addr) == first_lwp_addr) {
                        /*
                         * Switch to the zombie list, unless it is NULL
                         * or we have already been doing the zombie list,
                         * in which case terminate the loop.
                         */
                        if (first_zombie_addr == 0 ||
                            first_lwp_addr == first_zombie_addr)
                                break;
                        curr_lwp_addr = first_lwp_addr = first_zombie_addr;
                }
        }

        (void) ps_pcontinue(ph_p);
        ph_unlock(ta_p);
        return (return_val);
}

/*
 * Enable or disable process synchronization object tracking.
 * Currently unused by dbx.
 */
#pragma weak td_ta_sync_tracking_enable = __td_ta_sync_tracking_enable
td_err_e
__td_ta_sync_tracking_enable(td_thragent_t *ta_p, int onoff)
{
        struct ps_prochandle *ph_p;
        td_err_e return_val;
        register_sync_t enable;

        if ((ph_p = ph_lock_ta(ta_p, &return_val)) == NULL)
                return (return_val);
        /*
         * Values of tdb_register_sync in the victim process:
         *      REGISTER_SYNC_ENABLE    enables registration of synch objects
         *      REGISTER_SYNC_DISABLE   disables registration of synch objects
         * These cause the table to be cleared and tdb_register_sync set to:
         *      REGISTER_SYNC_ON        registration in effect
         *      REGISTER_SYNC_OFF       registration not in effect
         */
        enable = onoff? REGISTER_SYNC_ENABLE : REGISTER_SYNC_DISABLE;
        if (ps_pdwrite(ph_p, ta_p->tdb_register_sync_addr,
            &enable, sizeof (enable)) != PS_OK)
                return_val = TD_DBERR;
        /*
         * Remember that this interface was called (see td_ta_delete()).
         */
        ta_p->sync_tracking = 1;
        ph_unlock(ta_p);
        return (return_val);
}

/*
 * Iterate over all known synchronization variables.
 * It is very possible that the list generated is incomplete,
 * because the iterator can only find synchronization variables
 * that have been registered by the process since synchronization
 * object registration was enabled.
 * The call back function cb is called for each synchronization
 * variable with two arguments: a pointer to the synchronization
 * handle and the passed-in argument cbdata.
 * If cb returns a non-zero value, iterations are terminated.
 */
#pragma weak td_ta_sync_iter = __td_ta_sync_iter
td_err_e
__td_ta_sync_iter(td_thragent_t *ta_p, td_sync_iter_f *cb, void *cbdata)
{
        struct ps_prochandle *ph_p;
        td_err_e        return_val;
        int             i;
        register_sync_t enable;
        psaddr_t        next_desc;
        tdb_sync_stats_t sync_stats;
        td_synchandle_t synchandle;
        psaddr_t        psaddr;
        void            *vaddr;
        uint64_t        *sync_addr_hash = NULL;

        if (cb == NULL)
                return (TD_ERR);
        if ((ph_p = ph_lock_ta(ta_p, &return_val)) == NULL)
                return (return_val);
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(ta_p);
                return (TD_DBERR);
        }
        if (ps_pdread(ph_p, ta_p->tdb_register_sync_addr,
            &enable, sizeof (enable)) != PS_OK) {
                return_val = TD_DBERR;
                goto out;
        }
        if (enable != REGISTER_SYNC_ON)
                goto out;

        /*
         * First read the hash table.
         * The hash table is large; allocate with mmap().
         */
        if ((vaddr = mmap(NULL, TDB_HASH_SIZE * sizeof (uint64_t),
            PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, (off_t)0))
            == MAP_FAILED) {
                return_val = TD_MALLOC;
                goto out;
        }
        sync_addr_hash = vaddr;

        if (ta_p->model == PR_MODEL_NATIVE) {
                if (ps_pdread(ph_p, ta_p->uberdata_addr +
                    offsetof(uberdata_t, tdb.tdb_sync_addr_hash),
                    &psaddr, sizeof (&psaddr)) != PS_OK) {
                        return_val = TD_DBERR;
                        goto out;
                }
        } else {
#ifdef  _SYSCALL32
                caddr32_t addr;

                if (ps_pdread(ph_p, ta_p->uberdata_addr +
                    offsetof(uberdata32_t, tdb.tdb_sync_addr_hash),
                    &addr, sizeof (addr)) != PS_OK) {
                        return_val = TD_DBERR;
                        goto out;
                }
                psaddr = addr;
#else
                return_val = TD_ERR;
                goto out;
#endif /* _SYSCALL32 */
        }

        if (psaddr == 0)
                goto out;
        if (ps_pdread(ph_p, psaddr, sync_addr_hash,
            TDB_HASH_SIZE * sizeof (uint64_t)) != PS_OK) {
                return_val = TD_DBERR;
                goto out;
        }

        /*
         * Now scan the hash table.
         */
        for (i = 0; i < TDB_HASH_SIZE; i++) {
                for (next_desc = (psaddr_t)sync_addr_hash[i];
                    next_desc != 0;
                    next_desc = (psaddr_t)sync_stats.next) {
                        if (ps_pdread(ph_p, next_desc,
                            &sync_stats, sizeof (sync_stats)) != PS_OK) {
                                return_val = TD_DBERR;
                                goto out;
                        }
                        if (sync_stats.un.type == TDB_NONE) {
                                /* not registered since registration enabled */
                                continue;
                        }
                        synchandle.sh_ta_p = ta_p;
                        synchandle.sh_unique = (psaddr_t)sync_stats.sync_addr;
                        if ((*cb)(&synchandle, cbdata) != 0)
                                goto out;
                }
        }

out:
        if (sync_addr_hash != NULL)
                (void) munmap((void *)sync_addr_hash,
                    TDB_HASH_SIZE * sizeof (uint64_t));
        (void) ps_pcontinue(ph_p);
        ph_unlock(ta_p);
        return (return_val);
}

/*
 * Enable process statistics collection.
 */
#pragma weak td_ta_enable_stats = __td_ta_enable_stats
/* ARGSUSED */
td_err_e
__td_ta_enable_stats(const td_thragent_t *ta_p, int onoff)
{
        return (TD_NOCAPAB);
}

/*
 * Reset process statistics.
 */
#pragma weak td_ta_reset_stats = __td_ta_reset_stats
/* ARGSUSED */
td_err_e
__td_ta_reset_stats(const td_thragent_t *ta_p)
{
        return (TD_NOCAPAB);
}

/*
 * Read process statistics.
 */
#pragma weak td_ta_get_stats = __td_ta_get_stats
/* ARGSUSED */
td_err_e
__td_ta_get_stats(const td_thragent_t *ta_p, td_ta_stats_t *tstats)
{
        return (TD_NOCAPAB);
}

/*
 * Transfer information from lwp struct to thread information struct.
 * XXX -- lots of this needs cleaning up.
 */
static void
td_thr2to(td_thragent_t *ta_p, psaddr_t ts_addr,
    ulwp_t *ulwp, td_thrinfo_t *ti_p)
{
        lwpid_t lwpid;

        if ((lwpid = ulwp->ul_lwpid) == 0)
                lwpid = 1;
        (void) memset(ti_p, 0, sizeof (*ti_p));
        ti_p->ti_ta_p = ta_p;
        ti_p->ti_user_flags = ulwp->ul_usropts;
        ti_p->ti_tid = lwpid;
        ti_p->ti_exitval = ulwp->ul_rval;
        ti_p->ti_startfunc = (psaddr_t)ulwp->ul_startpc;
        if (!ulwp->ul_dead) {
                /*
                 * The bloody fools got this backwards!
                 */
                ti_p->ti_stkbase = (psaddr_t)ulwp->ul_stktop;
                ti_p->ti_stksize = ulwp->ul_stksiz;
        }
        ti_p->ti_ro_area = ts_addr;
        ti_p->ti_ro_size = ulwp->ul_replace?
            REPLACEMENT_SIZE : sizeof (ulwp_t);
        ti_p->ti_state = ulwp->ul_dead? TD_THR_ZOMBIE :
            ulwp->ul_stop? TD_THR_STOPPED :
            ulwp->ul_wchan? TD_THR_SLEEP :
            TD_THR_ACTIVE;
        ti_p->ti_db_suspended = 0;
        ti_p->ti_type = TD_THR_USER;
        ti_p->ti_sp = ulwp->ul_sp;
        ti_p->ti_flags = 0;
        ti_p->ti_pri = ulwp->ul_pri;
        ti_p->ti_lid = lwpid;
        if (!ulwp->ul_dead)
                ti_p->ti_sigmask = ulwp->ul_sigmask;
        ti_p->ti_traceme = 0;
        ti_p->ti_preemptflag = 0;
        ti_p->ti_pirecflag = 0;
        (void) sigemptyset(&ti_p->ti_pending);
        ti_p->ti_events = ulwp->ul_td_evbuf.eventmask;
}

#if defined(_LP64) && defined(_SYSCALL32)
static void
td_thr2to32(td_thragent_t *ta_p, psaddr_t ts_addr,
    ulwp32_t *ulwp, td_thrinfo_t *ti_p)
{
        lwpid_t lwpid;

        if ((lwpid = ulwp->ul_lwpid) == 0)
                lwpid = 1;
        (void) memset(ti_p, 0, sizeof (*ti_p));
        ti_p->ti_ta_p = ta_p;
        ti_p->ti_user_flags = ulwp->ul_usropts;
        ti_p->ti_tid = lwpid;
        ti_p->ti_exitval = (void *)(uintptr_t)ulwp->ul_rval;
        ti_p->ti_startfunc = (psaddr_t)ulwp->ul_startpc;
        if (!ulwp->ul_dead) {
                /*
                 * The bloody fools got this backwards!
                 */
                ti_p->ti_stkbase = (psaddr_t)ulwp->ul_stktop;
                ti_p->ti_stksize = ulwp->ul_stksiz;
        }
        ti_p->ti_ro_area = ts_addr;
        ti_p->ti_ro_size = ulwp->ul_replace?
            REPLACEMENT_SIZE32 : sizeof (ulwp32_t);
        ti_p->ti_state = ulwp->ul_dead? TD_THR_ZOMBIE :
            ulwp->ul_stop? TD_THR_STOPPED :
            ulwp->ul_wchan? TD_THR_SLEEP :
            TD_THR_ACTIVE;
        ti_p->ti_db_suspended = 0;
        ti_p->ti_type = TD_THR_USER;
        ti_p->ti_sp = (uint32_t)ulwp->ul_sp;
        ti_p->ti_flags = 0;
        ti_p->ti_pri = ulwp->ul_pri;
        ti_p->ti_lid = lwpid;
        if (!ulwp->ul_dead)
                ti_p->ti_sigmask = *(sigset_t *)&ulwp->ul_sigmask;
        ti_p->ti_traceme = 0;
        ti_p->ti_preemptflag = 0;
        ti_p->ti_pirecflag = 0;
        (void) sigemptyset(&ti_p->ti_pending);
        ti_p->ti_events = ulwp->ul_td_evbuf.eventmask;
}
#endif  /* _SYSCALL32 */

/*
 * Get thread information.
 */
#pragma weak td_thr_get_info = __td_thr_get_info
td_err_e
__td_thr_get_info(td_thrhandle_t *th_p, td_thrinfo_t *ti_p)
{
        struct ps_prochandle *ph_p;
        td_thragent_t   *ta_p;
        td_err_e        return_val;
        psaddr_t        psaddr;

        if (ti_p == NULL)
                return (TD_ERR);
        (void) memset(ti_p, 0, sizeof (*ti_p));

        if ((ph_p = ph_lock_th(th_p, &return_val)) == NULL)
                return (return_val);
        ta_p = th_p->th_ta_p;
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(ta_p);
                return (TD_DBERR);
        }

        /*
         * Read the ulwp struct from the process.
         * Transfer the ulwp struct to the thread information struct.
         */
        psaddr = th_p->th_unique;
        if (ta_p->model == PR_MODEL_NATIVE) {
                ulwp_t ulwp;

                if (ps_pdread(ph_p, psaddr, &ulwp, sizeof (ulwp)) != PS_OK &&
                    ((void) memset(&ulwp, 0, sizeof (ulwp)),
                    ps_pdread(ph_p, psaddr, &ulwp, REPLACEMENT_SIZE)) != PS_OK)
                        return_val = TD_DBERR;
                else
                        td_thr2to(ta_p, psaddr, &ulwp, ti_p);
        } else {
#if defined(_LP64) && defined(_SYSCALL32)
                ulwp32_t ulwp;

                if (ps_pdread(ph_p, psaddr, &ulwp, sizeof (ulwp)) != PS_OK &&
                    ((void) memset(&ulwp, 0, sizeof (ulwp)),
                    ps_pdread(ph_p, psaddr, &ulwp, REPLACEMENT_SIZE32)) !=
                    PS_OK)
                        return_val = TD_DBERR;
                else
                        td_thr2to32(ta_p, psaddr, &ulwp, ti_p);
#else
                return_val = TD_ERR;
#endif  /* _SYSCALL32 */
        }

        (void) ps_pcontinue(ph_p);
        ph_unlock(ta_p);
        return (return_val);
}

/*
 * Given a process and an event number, return information about
 * an address in the process or at which a breakpoint can be set
 * to monitor the event.
 */
#pragma weak td_ta_event_addr = __td_ta_event_addr
td_err_e
__td_ta_event_addr(td_thragent_t *ta_p, td_event_e event, td_notify_t *notify_p)
{
        if (ta_p == NULL)
                return (TD_BADTA);
        if (event < TD_MIN_EVENT_NUM || event > TD_MAX_EVENT_NUM)
                return (TD_NOEVENT);
        if (notify_p == NULL)
                return (TD_ERR);

        notify_p->type = NOTIFY_BPT;
        notify_p->u.bptaddr = ta_p->tdb_events[event - TD_MIN_EVENT_NUM];

        return (TD_OK);
}

/*
 * Add the events in eventset 2 to eventset 1.
 */
static void
eventsetaddset(td_thr_events_t *event1_p, td_thr_events_t *event2_p)
{
        int     i;

        for (i = 0; i < TD_EVENTSIZE; i++)
                event1_p->event_bits[i] |= event2_p->event_bits[i];
}

/*
 * Delete the events in eventset 2 from eventset 1.
 */
static void
eventsetdelset(td_thr_events_t *event1_p, td_thr_events_t *event2_p)
{
        int     i;

        for (i = 0; i < TD_EVENTSIZE; i++)
                event1_p->event_bits[i] &= ~event2_p->event_bits[i];
}

/*
 * Either add or delete the given event set from a thread's event mask.
 */
static td_err_e
mod_eventset(td_thrhandle_t *th_p, td_thr_events_t *events, int onoff)
{
        struct ps_prochandle *ph_p;
        td_err_e        return_val = TD_OK;
        char            enable;
        td_thr_events_t evset;
        psaddr_t        psaddr_evset;
        psaddr_t        psaddr_enab;

        if ((ph_p = ph_lock_th(th_p, &return_val)) == NULL)
                return (return_val);
        if (th_p->th_ta_p->model == PR_MODEL_NATIVE) {
                ulwp_t *ulwp = (ulwp_t *)th_p->th_unique;
                psaddr_evset = (psaddr_t)&ulwp->ul_td_evbuf.eventmask;
                psaddr_enab = (psaddr_t)&ulwp->ul_td_events_enable;
        } else {
#if defined(_LP64) && defined(_SYSCALL32)
                ulwp32_t *ulwp = (ulwp32_t *)th_p->th_unique;
                psaddr_evset = (psaddr_t)&ulwp->ul_td_evbuf.eventmask;
                psaddr_enab = (psaddr_t)&ulwp->ul_td_events_enable;
#else
                ph_unlock(th_p->th_ta_p);
                return (TD_ERR);
#endif  /* _SYSCALL32 */
        }
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(th_p->th_ta_p);
                return (TD_DBERR);
        }

        if (ps_pdread(ph_p, psaddr_evset, &evset, sizeof (evset)) != PS_OK)
                return_val = TD_DBERR;
        else {
                if (onoff)
                        eventsetaddset(&evset, events);
                else
                        eventsetdelset(&evset, events);
                if (ps_pdwrite(ph_p, psaddr_evset, &evset, sizeof (evset))
                    != PS_OK)
                        return_val = TD_DBERR;
                else {
                        enable = 0;
                        if (td_eventismember(&evset, TD_EVENTS_ENABLE))
                                enable = 1;
                        if (ps_pdwrite(ph_p, psaddr_enab,
                            &enable, sizeof (enable)) != PS_OK)
                                return_val = TD_DBERR;
                }
        }

        (void) ps_pcontinue(ph_p);
        ph_unlock(th_p->th_ta_p);
        return (return_val);
}

/*
 * Enable or disable tracing for a given thread.  Tracing
 * is filtered based on the event mask of each thread.  Tracing
 * can be turned on/off for the thread without changing thread
 * event mask.
 * Currently unused by dbx.
 */
#pragma weak td_thr_event_enable = __td_thr_event_enable
td_err_e
__td_thr_event_enable(td_thrhandle_t *th_p, int onoff)
{
        td_thr_events_t evset;

        td_event_emptyset(&evset);
        td_event_addset(&evset, TD_EVENTS_ENABLE);
        return (mod_eventset(th_p, &evset, onoff));
}

/*
 * Set event mask to enable event. event is turned on in
 * event mask for thread.  If a thread encounters an event
 * for which its event mask is on, notification will be sent
 * to the debugger.
 * Addresses for each event are provided to the
 * debugger.  It is assumed that a breakpoint of some type will
 * be placed at that address.  If the event mask for the thread
 * is on, the instruction at the address will be executed.
 * Otherwise, the instruction will be skipped.
 */
#pragma weak td_thr_set_event = __td_thr_set_event
td_err_e
__td_thr_set_event(td_thrhandle_t *th_p, td_thr_events_t *events)
{
        return (mod_eventset(th_p, events, 1));
}

/*
 * Enable or disable a set of events in the process-global event mask,
 * depending on the value of onoff.
 */
static td_err_e
td_ta_mod_event(td_thragent_t *ta_p, td_thr_events_t *events, int onoff)
{
        struct ps_prochandle *ph_p;
        td_thr_events_t targ_eventset;
        td_err_e        return_val;

        if ((ph_p = ph_lock_ta(ta_p, &return_val)) == NULL)
                return (return_val);
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(ta_p);
                return (TD_DBERR);
        }
        if (ps_pdread(ph_p, ta_p->tdb_eventmask_addr,
            &targ_eventset, sizeof (targ_eventset)) != PS_OK)
                return_val = TD_DBERR;
        else {
                if (onoff)
                        eventsetaddset(&targ_eventset, events);
                else
                        eventsetdelset(&targ_eventset, events);
                if (ps_pdwrite(ph_p, ta_p->tdb_eventmask_addr,
                    &targ_eventset, sizeof (targ_eventset)) != PS_OK)
                        return_val = TD_DBERR;
        }
        (void) ps_pcontinue(ph_p);
        ph_unlock(ta_p);
        return (return_val);
}

/*
 * Enable a set of events in the process-global event mask.
 */
#pragma weak td_ta_set_event = __td_ta_set_event
td_err_e
__td_ta_set_event(td_thragent_t *ta_p, td_thr_events_t *events)
{
        return (td_ta_mod_event(ta_p, events, 1));
}

/*
 * Set event mask to disable the given event set; these events are cleared
 * from the event mask of the thread.  Events that occur for a thread
 * with the event masked off will not cause notification to be
 * sent to the debugger (see td_thr_set_event for fuller description).
 */
#pragma weak td_thr_clear_event = __td_thr_clear_event
td_err_e
__td_thr_clear_event(td_thrhandle_t *th_p, td_thr_events_t *events)
{
        return (mod_eventset(th_p, events, 0));
}

/*
 * Disable a set of events in the process-global event mask.
 */
#pragma weak td_ta_clear_event = __td_ta_clear_event
td_err_e
__td_ta_clear_event(td_thragent_t *ta_p, td_thr_events_t *events)
{
        return (td_ta_mod_event(ta_p, events, 0));
}

/*
 * This function returns the most recent event message, if any,
 * associated with a thread.  Given a thread handle, return the message
 * corresponding to the event encountered by the thread.  Only one
 * message per thread is saved.  Messages from earlier events are lost
 * when later events occur.
 */
#pragma weak td_thr_event_getmsg = __td_thr_event_getmsg
td_err_e
__td_thr_event_getmsg(td_thrhandle_t *th_p, td_event_msg_t *msg)
{
        struct ps_prochandle *ph_p;
        td_err_e        return_val = TD_OK;
        psaddr_t        psaddr;

        if ((ph_p = ph_lock_th(th_p, &return_val)) == NULL)
                return (return_val);
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(th_p->th_ta_p);
                return (TD_BADTA);
        }
        if (th_p->th_ta_p->model == PR_MODEL_NATIVE) {
                ulwp_t *ulwp = (ulwp_t *)th_p->th_unique;
                td_evbuf_t evbuf;

                psaddr = (psaddr_t)&ulwp->ul_td_evbuf;
                if (ps_pdread(ph_p, psaddr, &evbuf, sizeof (evbuf)) != PS_OK) {
                        return_val = TD_DBERR;
                } else if (evbuf.eventnum == TD_EVENT_NONE) {
                        return_val = TD_NOEVENT;
                } else {
                        msg->event = evbuf.eventnum;
                        msg->th_p = (td_thrhandle_t *)th_p;
                        msg->msg.data = (uintptr_t)evbuf.eventdata;
                        /* "Consume" the message */
                        evbuf.eventnum = TD_EVENT_NONE;
                        evbuf.eventdata = NULL;
                        if (ps_pdwrite(ph_p, psaddr, &evbuf, sizeof (evbuf))
                            != PS_OK)
                                return_val = TD_DBERR;
                }
        } else {
#if defined(_LP64) && defined(_SYSCALL32)
                ulwp32_t *ulwp = (ulwp32_t *)th_p->th_unique;
                td_evbuf32_t evbuf;

                psaddr = (psaddr_t)&ulwp->ul_td_evbuf;
                if (ps_pdread(ph_p, psaddr, &evbuf, sizeof (evbuf)) != PS_OK) {
                        return_val = TD_DBERR;
                } else if (evbuf.eventnum == TD_EVENT_NONE) {
                        return_val = TD_NOEVENT;
                } else {
                        msg->event = evbuf.eventnum;
                        msg->th_p = (td_thrhandle_t *)th_p;
                        msg->msg.data = (uintptr_t)evbuf.eventdata;
                        /* "Consume" the message */
                        evbuf.eventnum = TD_EVENT_NONE;
                        evbuf.eventdata = 0;
                        if (ps_pdwrite(ph_p, psaddr, &evbuf, sizeof (evbuf))
                            != PS_OK)
                                return_val = TD_DBERR;
                }
#else
                return_val = TD_ERR;
#endif  /* _SYSCALL32 */
        }

        (void) ps_pcontinue(ph_p);
        ph_unlock(th_p->th_ta_p);
        return (return_val);
}

/*
 * The callback function td_ta_event_getmsg uses when looking for
 * a thread with an event.  A thin wrapper around td_thr_event_getmsg.
 */
static int
event_msg_cb(const td_thrhandle_t *th_p, void *arg)
{
        static td_thrhandle_t th;
        td_event_msg_t *msg = arg;

        if (__td_thr_event_getmsg((td_thrhandle_t *)th_p, msg) == TD_OK) {
                /*
                 * Got an event, stop iterating.
                 *
                 * Because of past mistakes in interface definition,
                 * we are forced to pass back a static local variable
                 * for the thread handle because th_p is a pointer
                 * to a local variable in __td_ta_thr_iter().
                 * Grr...
                 */
                th = *th_p;
                msg->th_p = &th;
                return (1);
        }
        return (0);
}

/*
 * This function is just like td_thr_event_getmsg, except that it is
 * passed a process handle rather than a thread handle, and returns
 * an event message for some thread in the process that has an event
 * message pending.  If no thread has an event message pending, this
 * routine returns TD_NOEVENT.  Thus, all pending event messages may
 * be collected from a process by repeatedly calling this routine
 * until it returns TD_NOEVENT.
 */
#pragma weak td_ta_event_getmsg = __td_ta_event_getmsg
td_err_e
__td_ta_event_getmsg(td_thragent_t *ta_p, td_event_msg_t *msg)
{
        td_err_e return_val;

        if (ta_p == NULL)
                return (TD_BADTA);
        if (ta_p->ph_p == NULL)
                return (TD_BADPH);
        if (msg == NULL)
                return (TD_ERR);
        msg->event = TD_EVENT_NONE;
        if ((return_val = __td_ta_thr_iter(ta_p, event_msg_cb, msg,
            TD_THR_ANY_STATE, TD_THR_LOWEST_PRIORITY, TD_SIGNO_MASK,
            TD_THR_ANY_USER_FLAGS)) != TD_OK)
                return (return_val);
        if (msg->event == TD_EVENT_NONE)
                return (TD_NOEVENT);
        return (TD_OK);
}

static lwpid_t
thr_to_lwpid(const td_thrhandle_t *th_p)
{
        struct ps_prochandle *ph_p = th_p->th_ta_p->ph_p;
        lwpid_t lwpid;

        /*
         * The caller holds the prochandle lock
         * and has already verfied everything.
         */
        if (th_p->th_ta_p->model == PR_MODEL_NATIVE) {
                ulwp_t *ulwp = (ulwp_t *)th_p->th_unique;

                if (ps_pdread(ph_p, (psaddr_t)&ulwp->ul_lwpid,
                    &lwpid, sizeof (lwpid)) != PS_OK)
                        lwpid = 0;
                else if (lwpid == 0)
                        lwpid = 1;
        } else {
#if defined(_LP64) && defined(_SYSCALL32)
                ulwp32_t *ulwp = (ulwp32_t *)th_p->th_unique;

                if (ps_pdread(ph_p, (psaddr_t)&ulwp->ul_lwpid,
                    &lwpid, sizeof (lwpid)) != PS_OK)
                        lwpid = 0;
                else if (lwpid == 0)
                        lwpid = 1;
#else
                lwpid = 0;
#endif  /* _SYSCALL32 */
        }

        return (lwpid);
}

/*
 * Suspend a thread.
 * XXX: What does this mean in a one-level model?
 */
#pragma weak td_thr_dbsuspend = __td_thr_dbsuspend
td_err_e
__td_thr_dbsuspend(const td_thrhandle_t *th_p)
{
        struct ps_prochandle *ph_p;
        td_err_e return_val;

        if ((ph_p = ph_lock_th(th_p, &return_val)) == NULL)
                return (return_val);
        if (ps_lstop(ph_p, thr_to_lwpid(th_p)) != PS_OK)
                return_val = TD_DBERR;
        ph_unlock(th_p->th_ta_p);
        return (return_val);
}

/*
 * Resume a suspended thread.
 * XXX: What does this mean in a one-level model?
 */
#pragma weak td_thr_dbresume = __td_thr_dbresume
td_err_e
__td_thr_dbresume(const td_thrhandle_t *th_p)
{
        struct ps_prochandle *ph_p;
        td_err_e return_val;

        if ((ph_p = ph_lock_th(th_p, &return_val)) == NULL)
                return (return_val);
        if (ps_lcontinue(ph_p, thr_to_lwpid(th_p)) != PS_OK)
                return_val = TD_DBERR;
        ph_unlock(th_p->th_ta_p);
        return (return_val);
}

/*
 * Set a thread's signal mask.
 * Currently unused by dbx.
 */
#pragma weak td_thr_sigsetmask = __td_thr_sigsetmask
/* ARGSUSED */
td_err_e
__td_thr_sigsetmask(const td_thrhandle_t *th_p, const sigset_t ti_sigmask)
{
        return (TD_NOCAPAB);
}

/*
 * Set a thread's "signals-pending" set.
 * Currently unused by dbx.
 */
#pragma weak td_thr_setsigpending = __td_thr_setsigpending
/* ARGSUSED */
td_err_e
__td_thr_setsigpending(const td_thrhandle_t *th_p,
    uchar_t ti_pending_flag, const sigset_t ti_pending)
{
        return (TD_NOCAPAB);
}

/*
 * Get a thread's general register set.
 */
#pragma weak td_thr_getgregs = __td_thr_getgregs
td_err_e
__td_thr_getgregs(td_thrhandle_t *th_p, prgregset_t regset)
{
        struct ps_prochandle *ph_p;
        td_err_e return_val;

        if ((ph_p = ph_lock_th(th_p, &return_val)) == NULL)
                return (return_val);
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(th_p->th_ta_p);
                return (TD_DBERR);
        }

        if (ps_lgetregs(ph_p, thr_to_lwpid(th_p), regset) != PS_OK)
                return_val = TD_DBERR;

        (void) ps_pcontinue(ph_p);
        ph_unlock(th_p->th_ta_p);
        return (return_val);
}

/*
 * Set a thread's general register set.
 */
#pragma weak td_thr_setgregs = __td_thr_setgregs
td_err_e
__td_thr_setgregs(td_thrhandle_t *th_p, const prgregset_t regset)
{
        struct ps_prochandle *ph_p;
        td_err_e return_val;

        if ((ph_p = ph_lock_th(th_p, &return_val)) == NULL)
                return (return_val);
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(th_p->th_ta_p);
                return (TD_DBERR);
        }

        if (ps_lsetregs(ph_p, thr_to_lwpid(th_p), regset) != PS_OK)
                return_val = TD_DBERR;

        (void) ps_pcontinue(ph_p);
        ph_unlock(th_p->th_ta_p);
        return (return_val);
}

/*
 * Get a thread's floating-point register set.
 */
#pragma weak td_thr_getfpregs = __td_thr_getfpregs
td_err_e
__td_thr_getfpregs(td_thrhandle_t *th_p, prfpregset_t *fpregset)
{
        struct ps_prochandle *ph_p;
        td_err_e return_val;

        if ((ph_p = ph_lock_th(th_p, &return_val)) == NULL)
                return (return_val);
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(th_p->th_ta_p);
                return (TD_DBERR);
        }

        if (ps_lgetfpregs(ph_p, thr_to_lwpid(th_p), fpregset) != PS_OK)
                return_val = TD_DBERR;

        (void) ps_pcontinue(ph_p);
        ph_unlock(th_p->th_ta_p);
        return (return_val);
}

/*
 * Set a thread's floating-point register set.
 */
#pragma weak td_thr_setfpregs = __td_thr_setfpregs
td_err_e
__td_thr_setfpregs(td_thrhandle_t *th_p, const prfpregset_t *fpregset)
{
        struct ps_prochandle *ph_p;
        td_err_e return_val;

        if ((ph_p = ph_lock_th(th_p, &return_val)) == NULL)
                return (return_val);
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(th_p->th_ta_p);
                return (TD_DBERR);
        }

        if (ps_lsetfpregs(ph_p, thr_to_lwpid(th_p), fpregset) != PS_OK)
                return_val = TD_DBERR;

        (void) ps_pcontinue(ph_p);
        ph_unlock(th_p->th_ta_p);
        return (return_val);
}

/*
 * Get the size of the extra state register set for this architecture.
 * Currently unused by dbx.
 */
#pragma weak td_thr_getxregsize = __td_thr_getxregsize
/* ARGSUSED */
td_err_e
__td_thr_getxregsize(td_thrhandle_t *th_p, int *xregsize)
{
        struct ps_prochandle *ph_p;
        td_err_e return_val;

        if ((ph_p = ph_lock_th(th_p, &return_val)) == NULL)
                return (return_val);
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(th_p->th_ta_p);
                return (TD_DBERR);
        }

        if (ps_lgetxregsize(ph_p, thr_to_lwpid(th_p), xregsize) != PS_OK)
                return_val = TD_DBERR;

        if (*xregsize == 0)
                return_val = TD_NOXREGS;

        (void) ps_pcontinue(ph_p);
        ph_unlock(th_p->th_ta_p);
        return (return_val);
}

/*
 * Get a thread's extra state register set.
 */
#pragma weak td_thr_getxregs = __td_thr_getxregs
td_err_e
__td_thr_getxregs(td_thrhandle_t *th_p, void *xregset)
{
        struct ps_prochandle *ph_p;
        td_err_e return_val;
        ps_err_e ps_err;

        if ((ph_p = ph_lock_th(th_p, &return_val)) == NULL)
                return (return_val);
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(th_p->th_ta_p);
                return (TD_DBERR);
        }

        ps_err = ps_lgetxregs(ph_p, thr_to_lwpid(th_p), (caddr_t)xregset);
        if (ps_err == PS_NOXREGS)
                return_val = TD_NOXREGS;
        else if (ps_err != PS_OK)
                return_val = TD_DBERR;

        (void) ps_pcontinue(ph_p);
        ph_unlock(th_p->th_ta_p);
        return (return_val);
}

/*
 * Set a thread's extra state register set.
 */
#pragma weak td_thr_setxregs = __td_thr_setxregs
td_err_e
__td_thr_setxregs(td_thrhandle_t *th_p, const void *xregset)
{
        struct ps_prochandle *ph_p;
        td_err_e return_val;

        if ((ph_p = ph_lock_th(th_p, &return_val)) == NULL)
                return (return_val);
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(th_p->th_ta_p);
                return (TD_DBERR);
        }

        if (ps_lsetxregs(ph_p, thr_to_lwpid(th_p), (caddr_t)xregset) != PS_OK)
                return_val = TD_DBERR;

        (void) ps_pcontinue(ph_p);
        ph_unlock(th_p->th_ta_p);
        return (return_val);
}

struct searcher {
        psaddr_t        addr;
        int             status;
};

/*
 * Check the struct thread address in *th_p again first
 * value in "data".  If value in data is found, set second value
 * in "data" to 1 and return 1 to terminate iterations.
 * This function is used by td_thr_validate() to verify that
 * a thread handle is valid.
 */
static int
td_searcher(const td_thrhandle_t *th_p, void *data)
{
        struct searcher *searcher_data = (struct searcher *)data;

        if (searcher_data->addr == th_p->th_unique) {
                searcher_data->status = 1;
                return (1);
        }
        return (0);
}

/*
 * Validate the thread handle.  Check that
 * a thread exists in the thread agent/process that
 * corresponds to thread with handle *th_p.
 * Currently unused by dbx.
 */
#pragma weak td_thr_validate = __td_thr_validate
td_err_e
__td_thr_validate(const td_thrhandle_t *th_p)
{
        td_err_e return_val;
        struct searcher searcher_data = {0, 0};

        if (th_p == NULL)
                return (TD_BADTH);
        if (th_p->th_unique == 0 || th_p->th_ta_p == NULL)
                return (TD_BADTH);

        /*
         * LOCKING EXCEPTION - Locking is not required
         * here because no use of the thread agent is made (other
         * than the sanity check) and checking of the thread
         * agent will be done in __td_ta_thr_iter.
         */

        searcher_data.addr = th_p->th_unique;
        return_val = __td_ta_thr_iter(th_p->th_ta_p,
            td_searcher, &searcher_data,
            TD_THR_ANY_STATE, TD_THR_LOWEST_PRIORITY,
            TD_SIGNO_MASK, TD_THR_ANY_USER_FLAGS);

        if (return_val == TD_OK && searcher_data.status == 0)
                return_val = TD_NOTHR;

        return (return_val);
}

/*
 * Get a thread's private binding to a given thread specific
 * data(TSD) key(see thr_getspecific(3C).  If the thread doesn't
 * have a binding for a particular key, then NULL is returned.
 */
#pragma weak td_thr_tsd = __td_thr_tsd
td_err_e
__td_thr_tsd(td_thrhandle_t *th_p, thread_key_t key, void **data_pp)
{
        struct ps_prochandle *ph_p;
        td_thragent_t   *ta_p;
        td_err_e        return_val;
        int             maxkey;
        int             nkey;
        psaddr_t        tsd_paddr;

        if (data_pp == NULL)
                return (TD_ERR);
        *data_pp = NULL;
        if ((ph_p = ph_lock_th(th_p, &return_val)) == NULL)
                return (return_val);
        ta_p = th_p->th_ta_p;
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(ta_p);
                return (TD_DBERR);
        }

        if (ta_p->model == PR_MODEL_NATIVE) {
                ulwp_t *ulwp = (ulwp_t *)th_p->th_unique;
                tsd_metadata_t tsdm;
                tsd_t stsd;

                if (ps_pdread(ph_p,
                    ta_p->uberdata_addr + offsetof(uberdata_t, tsd_metadata),
                    &tsdm, sizeof (tsdm)) != PS_OK)
                        return_val = TD_DBERR;
                else if (ps_pdread(ph_p, (psaddr_t)&ulwp->ul_stsd,
                    &tsd_paddr, sizeof (tsd_paddr)) != PS_OK)
                        return_val = TD_DBERR;
                else if (tsd_paddr != 0 &&
                    ps_pdread(ph_p, tsd_paddr, &stsd, sizeof (stsd)) != PS_OK)
                        return_val = TD_DBERR;
                else {
                        maxkey = tsdm.tsdm_nused;
                        nkey = tsd_paddr == 0 ? TSD_NFAST : stsd.tsd_nalloc;

                        if (key < TSD_NFAST)
                                tsd_paddr = (psaddr_t)&ulwp->ul_ftsd[0];
                }
        } else {
#if defined(_LP64) && defined(_SYSCALL32)
                ulwp32_t *ulwp = (ulwp32_t *)th_p->th_unique;
                tsd_metadata32_t tsdm;
                tsd32_t stsd;
                caddr32_t addr;

                if (ps_pdread(ph_p,
                    ta_p->uberdata_addr + offsetof(uberdata32_t, tsd_metadata),
                    &tsdm, sizeof (tsdm)) != PS_OK)
                        return_val = TD_DBERR;
                else if (ps_pdread(ph_p, (psaddr_t)&ulwp->ul_stsd,
                    &addr, sizeof (addr)) != PS_OK)
                        return_val = TD_DBERR;
                else if (addr != 0 &&
                    ps_pdread(ph_p, addr, &stsd, sizeof (stsd)) != PS_OK)
                        return_val = TD_DBERR;
                else {
                        maxkey = tsdm.tsdm_nused;
                        nkey = addr == 0 ? TSD_NFAST : stsd.tsd_nalloc;

                        if (key < TSD_NFAST) {
                                tsd_paddr = (psaddr_t)&ulwp->ul_ftsd[0];
                        } else {
                                tsd_paddr = addr;
                        }
                }
#else
                return_val = TD_ERR;
#endif  /* _SYSCALL32 */
        }

        if (return_val == TD_OK && (key < 1 || key >= maxkey))
                return_val = TD_NOTSD;
        if (return_val != TD_OK || key >= nkey) {
                /* NULL has already been stored in data_pp */
                (void) ps_pcontinue(ph_p);
                ph_unlock(ta_p);
                return (return_val);
        }

        /*
         * Read the value from the thread's tsd array.
         */
        if (ta_p->model == PR_MODEL_NATIVE) {
                void *value;

                if (ps_pdread(ph_p, tsd_paddr + key * sizeof (void *),
                    &value, sizeof (value)) != PS_OK)
                        return_val = TD_DBERR;
                else
                        *data_pp = value;
#if defined(_LP64) && defined(_SYSCALL32)
        } else {
                caddr32_t value32;

                if (ps_pdread(ph_p, tsd_paddr + key * sizeof (caddr32_t),
                    &value32, sizeof (value32)) != PS_OK)
                        return_val = TD_DBERR;
                else
                        *data_pp = (void *)(uintptr_t)value32;
#endif  /* _SYSCALL32 */
        }

        (void) ps_pcontinue(ph_p);
        ph_unlock(ta_p);
        return (return_val);
}

/*
 * Get the base address of a thread's thread local storage (TLS) block
 * for the module (executable or shared object) identified by 'moduleid'.
 */
#pragma weak td_thr_tlsbase = __td_thr_tlsbase
td_err_e
__td_thr_tlsbase(td_thrhandle_t *th_p, ulong_t moduleid, psaddr_t *base)
{
        struct ps_prochandle *ph_p;
        td_thragent_t   *ta_p;
        td_err_e        return_val;

        if (base == NULL)
                return (TD_ERR);
        *base = 0;
        if ((ph_p = ph_lock_th(th_p, &return_val)) == NULL)
                return (return_val);
        ta_p = th_p->th_ta_p;
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(ta_p);
                return (TD_DBERR);
        }

        if (ta_p->model == PR_MODEL_NATIVE) {
                ulwp_t *ulwp = (ulwp_t *)th_p->th_unique;
                tls_metadata_t tls_metadata;
                TLS_modinfo tlsmod;
                tls_t tls;

                if (ps_pdread(ph_p,
                    ta_p->uberdata_addr + offsetof(uberdata_t, tls_metadata),
                    &tls_metadata, sizeof (tls_metadata)) != PS_OK)
                        return_val = TD_DBERR;
                else if (moduleid >= tls_metadata.tls_modinfo.tls_size)
                        return_val = TD_NOTLS;
                else if (ps_pdread(ph_p,
                    (psaddr_t)((TLS_modinfo *)
                    tls_metadata.tls_modinfo.tls_data + moduleid),
                    &tlsmod, sizeof (tlsmod)) != PS_OK)
                        return_val = TD_DBERR;
                else if (tlsmod.tm_memsz == 0)
                        return_val = TD_NOTLS;
                else if (tlsmod.tm_flags & TM_FLG_STATICTLS)
                        *base = (psaddr_t)ulwp - tlsmod.tm_stattlsoffset;
                else if (ps_pdread(ph_p, (psaddr_t)&ulwp->ul_tls,
                    &tls, sizeof (tls)) != PS_OK)
                        return_val = TD_DBERR;
                else if (moduleid >= tls.tls_size)
                        return_val = TD_TLSDEFER;
                else if (ps_pdread(ph_p,
                    (psaddr_t)((tls_t *)tls.tls_data + moduleid),
                    &tls, sizeof (tls)) != PS_OK)
                        return_val = TD_DBERR;
                else if (tls.tls_size == 0)
                        return_val = TD_TLSDEFER;
                else
                        *base = (psaddr_t)tls.tls_data;
        } else {
#if defined(_LP64) && defined(_SYSCALL32)
                ulwp32_t *ulwp = (ulwp32_t *)th_p->th_unique;
                tls_metadata32_t tls_metadata;
                TLS_modinfo32 tlsmod;
                tls32_t tls;

                if (ps_pdread(ph_p,
                    ta_p->uberdata_addr + offsetof(uberdata32_t, tls_metadata),
                    &tls_metadata, sizeof (tls_metadata)) != PS_OK)
                        return_val = TD_DBERR;
                else if (moduleid >= tls_metadata.tls_modinfo.tls_size)
                        return_val = TD_NOTLS;
                else if (ps_pdread(ph_p,
                    (psaddr_t)((TLS_modinfo32 *)
                    (uintptr_t)tls_metadata.tls_modinfo.tls_data + moduleid),
                    &tlsmod, sizeof (tlsmod)) != PS_OK)
                        return_val = TD_DBERR;
                else if (tlsmod.tm_memsz == 0)
                        return_val = TD_NOTLS;
                else if (tlsmod.tm_flags & TM_FLG_STATICTLS)
                        *base = (psaddr_t)ulwp - tlsmod.tm_stattlsoffset;
                else if (ps_pdread(ph_p, (psaddr_t)&ulwp->ul_tls,
                    &tls, sizeof (tls)) != PS_OK)
                        return_val = TD_DBERR;
                else if (moduleid >= tls.tls_size)
                        return_val = TD_TLSDEFER;
                else if (ps_pdread(ph_p,
                    (psaddr_t)((tls32_t *)(uintptr_t)tls.tls_data + moduleid),
                    &tls, sizeof (tls)) != PS_OK)
                        return_val = TD_DBERR;
                else if (tls.tls_size == 0)
                        return_val = TD_TLSDEFER;
                else
                        *base = (psaddr_t)tls.tls_data;
#else
                return_val = TD_ERR;
#endif  /* _SYSCALL32 */
        }

        (void) ps_pcontinue(ph_p);
        ph_unlock(ta_p);
        return (return_val);
}

/*
 * Change a thread's priority to the value specified by ti_pri.
 * Currently unused by dbx.
 */
#pragma weak td_thr_setprio = __td_thr_setprio
/* ARGSUSED */
td_err_e
__td_thr_setprio(td_thrhandle_t *th_p, int ti_pri)
{
        return (TD_NOCAPAB);
}

/*
 * This structure links td_thr_lockowner and the lowner_cb callback function.
 */
typedef struct {
        td_sync_iter_f  *owner_cb;
        void            *owner_cb_arg;
        td_thrhandle_t  *th_p;
} lowner_cb_ctl_t;

static int
lowner_cb(const td_synchandle_t *sh_p, void *arg)
{
        lowner_cb_ctl_t *ocb = arg;
        int trunc = 0;
        union {
                rwlock_t rwl;
                mutex_t mx;
        } rw_m;

        if (ps_pdread(sh_p->sh_ta_p->ph_p, sh_p->sh_unique,
            &rw_m, sizeof (rw_m)) != PS_OK) {
                trunc = 1;
                if (ps_pdread(sh_p->sh_ta_p->ph_p, sh_p->sh_unique,
                    &rw_m.mx, sizeof (rw_m.mx)) != PS_OK)
                        return (0);
        }
        if (rw_m.mx.mutex_magic == MUTEX_MAGIC &&
            rw_m.mx.mutex_owner == ocb->th_p->th_unique)
                return ((ocb->owner_cb)(sh_p, ocb->owner_cb_arg));
        if (!trunc && rw_m.rwl.magic == RWL_MAGIC) {
                mutex_t *rwlock = &rw_m.rwl.mutex;
                if (rwlock->mutex_owner == ocb->th_p->th_unique)
                        return ((ocb->owner_cb)(sh_p, ocb->owner_cb_arg));
        }
        return (0);
}

/*
 * Iterate over the set of locks owned by a specified thread.
 * If cb returns a non-zero value, terminate iterations.
 */
#pragma weak td_thr_lockowner = __td_thr_lockowner
td_err_e
__td_thr_lockowner(const td_thrhandle_t *th_p, td_sync_iter_f *cb,
    void *cb_data)
{
        td_thragent_t   *ta_p;
        td_err_e        return_val;
        lowner_cb_ctl_t lcb;

        /*
         * Just sanity checks.
         */
        if (ph_lock_th((td_thrhandle_t *)th_p, &return_val) == NULL)
                return (return_val);
        ta_p = th_p->th_ta_p;
        ph_unlock(ta_p);

        lcb.owner_cb = cb;
        lcb.owner_cb_arg = cb_data;
        lcb.th_p = (td_thrhandle_t *)th_p;
        return (__td_ta_sync_iter(ta_p, lowner_cb, &lcb));
}

/*
 * If a thread is asleep on a synchronization variable,
 * then get the synchronization handle.
 */
#pragma weak td_thr_sleepinfo = __td_thr_sleepinfo
td_err_e
__td_thr_sleepinfo(const td_thrhandle_t *th_p, td_synchandle_t *sh_p)
{
        struct ps_prochandle *ph_p;
        td_err_e        return_val = TD_OK;
        uintptr_t       wchan;

        if (sh_p == NULL)
                return (TD_ERR);
        if ((ph_p = ph_lock_th((td_thrhandle_t *)th_p, &return_val)) == NULL)
                return (return_val);

        /*
         * No need to stop the process for a simple read.
         */
        if (th_p->th_ta_p->model == PR_MODEL_NATIVE) {
                ulwp_t *ulwp = (ulwp_t *)th_p->th_unique;

                if (ps_pdread(ph_p, (psaddr_t)&ulwp->ul_wchan,
                    &wchan, sizeof (wchan)) != PS_OK)
                        return_val = TD_DBERR;
        } else {
#if defined(_LP64) && defined(_SYSCALL32)
                ulwp32_t *ulwp = (ulwp32_t *)th_p->th_unique;
                caddr32_t wchan32;

                if (ps_pdread(ph_p, (psaddr_t)&ulwp->ul_wchan,
                    &wchan32, sizeof (wchan32)) != PS_OK)
                        return_val = TD_DBERR;
                wchan = wchan32;
#else
                return_val = TD_ERR;
#endif  /* _SYSCALL32 */
        }

        if (return_val != TD_OK || wchan == 0) {
                sh_p->sh_ta_p = NULL;
                sh_p->sh_unique = 0;
                if (return_val == TD_OK)
                        return_val = TD_ERR;
        } else {
                sh_p->sh_ta_p = th_p->th_ta_p;
                sh_p->sh_unique = (psaddr_t)wchan;
        }

        ph_unlock(th_p->th_ta_p);
        return (return_val);
}

/*
 * Which thread is running on an lwp?
 */
#pragma weak td_ta_map_lwp2thr = __td_ta_map_lwp2thr
td_err_e
__td_ta_map_lwp2thr(td_thragent_t *ta_p, lwpid_t lwpid,
    td_thrhandle_t *th_p)
{
        return (__td_ta_map_id2thr(ta_p, lwpid, th_p));
}

/*
 * Common code for td_sync_get_info() and td_sync_get_stats()
 */
static td_err_e
sync_get_info_common(const td_synchandle_t *sh_p, struct ps_prochandle *ph_p,
    td_syncinfo_t *si_p)
{
        int trunc = 0;
        td_so_un_t generic_so;

        /*
         * Determine the sync. object type; a little type fudgery here.
         * First attempt to read the whole union.  If that fails, attempt
         * to read just the condvar.  A condvar is the smallest sync. object.
         */
        if (ps_pdread(ph_p, sh_p->sh_unique,
            &generic_so, sizeof (generic_so)) != PS_OK) {
                trunc = 1;
                if (ps_pdread(ph_p, sh_p->sh_unique, &generic_so.condition,
                    sizeof (generic_so.condition)) != PS_OK)
                        return (TD_DBERR);
        }

        switch (generic_so.condition.cond_magic) {
        case MUTEX_MAGIC:
                if (trunc && ps_pdread(ph_p, sh_p->sh_unique,
                    &generic_so.lock, sizeof (generic_so.lock)) != PS_OK)
                        return (TD_DBERR);
                si_p->si_type = TD_SYNC_MUTEX;
                si_p->si_shared_type =
                    (generic_so.lock.mutex_type & USYNC_PROCESS);
                (void) memcpy(si_p->si_flags, &generic_so.lock.mutex_flag,
                    sizeof (generic_so.lock.mutex_flag));
                si_p->si_state.mutex_locked =
                    (generic_so.lock.mutex_lockw != 0);
                si_p->si_size = sizeof (generic_so.lock);
                si_p->si_has_waiters = generic_so.lock.mutex_waiters;
                si_p->si_rcount = generic_so.lock.mutex_rcount;
                si_p->si_prioceiling = generic_so.lock.mutex_ceiling;
                if (si_p->si_state.mutex_locked) {
                        if (si_p->si_shared_type & USYNC_PROCESS)
                                si_p->si_ownerpid =
                                    generic_so.lock.mutex_ownerpid;
                        si_p->si_owner.th_ta_p = sh_p->sh_ta_p;
                        si_p->si_owner.th_unique = generic_so.lock.mutex_owner;
                }
                break;
        case COND_MAGIC:
                si_p->si_type = TD_SYNC_COND;
                si_p->si_shared_type =
                    (generic_so.condition.cond_type & USYNC_PROCESS);
                (void) memcpy(si_p->si_flags, generic_so.condition.flags.flag,
                    sizeof (generic_so.condition.flags.flag));
                si_p->si_size = sizeof (generic_so.condition);
                si_p->si_has_waiters =
                    (generic_so.condition.cond_waiters_user |
                    generic_so.condition.cond_waiters_kernel)? 1 : 0;
                break;
        case SEMA_MAGIC:
                if (trunc && ps_pdread(ph_p, sh_p->sh_unique,
                    &generic_so.semaphore, sizeof (generic_so.semaphore))
                    != PS_OK)
                        return (TD_DBERR);
                si_p->si_type = TD_SYNC_SEMA;
                si_p->si_shared_type =
                    (generic_so.semaphore.type & USYNC_PROCESS);
                si_p->si_state.sem_count = generic_so.semaphore.count;
                si_p->si_size = sizeof (generic_so.semaphore);
                si_p->si_has_waiters =
                    ((lwp_sema_t *)&generic_so.semaphore)->flags[7];
                /* this is useless but the old interface provided it */
                si_p->si_data = (psaddr_t)generic_so.semaphore.count;
                break;
        case RWL_MAGIC:
        {
                uint32_t rwstate;

                if (trunc && ps_pdread(ph_p, sh_p->sh_unique,
                    &generic_so.rwlock, sizeof (generic_so.rwlock)) != PS_OK)
                        return (TD_DBERR);
                si_p->si_type = TD_SYNC_RWLOCK;
                si_p->si_shared_type =
                    (generic_so.rwlock.rwlock_type & USYNC_PROCESS);
                si_p->si_size = sizeof (generic_so.rwlock);

                rwstate = (uint32_t)generic_so.rwlock.rwlock_readers;
                if (rwstate & URW_WRITE_LOCKED) {
                        si_p->si_state.nreaders = -1;
                        si_p->si_is_wlock = 1;
                        si_p->si_owner.th_ta_p = sh_p->sh_ta_p;
                        si_p->si_owner.th_unique =
                            generic_so.rwlock.rwlock_owner;
                        if (si_p->si_shared_type & USYNC_PROCESS)
                                si_p->si_ownerpid =
                                    generic_so.rwlock.rwlock_ownerpid;
                } else {
                        si_p->si_state.nreaders = (rwstate & URW_READERS_MASK);
                }
                si_p->si_has_waiters = ((rwstate & URW_HAS_WAITERS) != 0);

                /* this is useless but the old interface provided it */
                si_p->si_data = (psaddr_t)generic_so.rwlock.readers;
                break;
        }
        default:
                return (TD_BADSH);
        }

        si_p->si_ta_p = sh_p->sh_ta_p;
        si_p->si_sv_addr = sh_p->sh_unique;
        return (TD_OK);
}

/*
 * Given a synchronization handle, fill in the
 * information for the synchronization variable into *si_p.
 */
#pragma weak td_sync_get_info = __td_sync_get_info
td_err_e
__td_sync_get_info(const td_synchandle_t *sh_p, td_syncinfo_t *si_p)
{
        struct ps_prochandle *ph_p;
        td_err_e return_val;

        if (si_p == NULL)
                return (TD_ERR);
        (void) memset(si_p, 0, sizeof (*si_p));
        if ((ph_p = ph_lock_sh(sh_p, &return_val)) == NULL)
                return (return_val);
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(sh_p->sh_ta_p);
                return (TD_DBERR);
        }

        return_val = sync_get_info_common(sh_p, ph_p, si_p);

        (void) ps_pcontinue(ph_p);
        ph_unlock(sh_p->sh_ta_p);
        return (return_val);
}

static uint_t
tdb_addr_hash64(uint64_t addr)
{
        uint64_t value60 = (addr >> 4);
        uint32_t value30 = (value60 >> 30) ^ (value60 & 0x3fffffff);
        return ((value30 >> 15) ^ (value30 & 0x7fff));
}

static uint_t
tdb_addr_hash32(uint64_t addr)
{
        uint32_t value30 = (addr >> 2);         /* 30 bits */
        return ((value30 >> 15) ^ (value30 & 0x7fff));
}

static td_err_e
read_sync_stats(td_thragent_t *ta_p, psaddr_t hash_table,
    psaddr_t sync_obj_addr, tdb_sync_stats_t *sync_stats)
{
        psaddr_t next_desc;
        uint64_t first;
        uint_t ix;

        /*
         * Compute the hash table index from the synch object's address.
         */
        if (ta_p->model == PR_MODEL_LP64)
                ix = tdb_addr_hash64(sync_obj_addr);
        else
                ix = tdb_addr_hash32(sync_obj_addr);

        /*
         * Get the address of the first element in the linked list.
         */
        if (ps_pdread(ta_p->ph_p, hash_table + ix * sizeof (uint64_t),
            &first, sizeof (first)) != PS_OK)
                return (TD_DBERR);

        /*
         * Search the linked list for an entry for the synch object..
         */
        for (next_desc = (psaddr_t)first; next_desc != 0;
            next_desc = (psaddr_t)sync_stats->next) {
                if (ps_pdread(ta_p->ph_p, next_desc,
                    sync_stats, sizeof (*sync_stats)) != PS_OK)
                        return (TD_DBERR);
                if (sync_stats->sync_addr == sync_obj_addr)
                        return (TD_OK);
        }

        (void) memset(sync_stats, 0, sizeof (*sync_stats));
        return (TD_OK);
}

/*
 * Given a synchronization handle, fill in the
 * statistics for the synchronization variable into *ss_p.
 */
#pragma weak td_sync_get_stats = __td_sync_get_stats
td_err_e
__td_sync_get_stats(const td_synchandle_t *sh_p, td_syncstats_t *ss_p)
{
        struct ps_prochandle *ph_p;
        td_thragent_t *ta_p;
        td_err_e return_val;
        register_sync_t enable;
        psaddr_t hashaddr;
        tdb_sync_stats_t sync_stats;
        size_t ix;

        if (ss_p == NULL)
                return (TD_ERR);
        (void) memset(ss_p, 0, sizeof (*ss_p));
        if ((ph_p = ph_lock_sh(sh_p, &return_val)) == NULL)
                return (return_val);
        ta_p = sh_p->sh_ta_p;
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(ta_p);
                return (TD_DBERR);
        }

        if ((return_val = sync_get_info_common(sh_p, ph_p, &ss_p->ss_info))
            != TD_OK) {
                if (return_val != TD_BADSH)
                        goto out;
                /* we can correct TD_BADSH */
                (void) memset(&ss_p->ss_info, 0, sizeof (ss_p->ss_info));
                ss_p->ss_info.si_ta_p = sh_p->sh_ta_p;
                ss_p->ss_info.si_sv_addr = sh_p->sh_unique;
                /* we correct si_type and si_size below */
                return_val = TD_OK;
        }
        if (ps_pdread(ph_p, ta_p->tdb_register_sync_addr,
            &enable, sizeof (enable)) != PS_OK) {
                return_val = TD_DBERR;
                goto out;
        }
        if (enable != REGISTER_SYNC_ON)
                goto out;

        /*
         * Get the address of the hash table in the target process.
         */
        if (ta_p->model == PR_MODEL_NATIVE) {
                if (ps_pdread(ph_p, ta_p->uberdata_addr +
                    offsetof(uberdata_t, tdb.tdb_sync_addr_hash),
                    &hashaddr, sizeof (&hashaddr)) != PS_OK) {
                        return_val = TD_DBERR;
                        goto out;
                }
        } else {
#if defined(_LP64) && defined(_SYSCALL32)
                caddr32_t addr;

                if (ps_pdread(ph_p, ta_p->uberdata_addr +
                    offsetof(uberdata32_t, tdb.tdb_sync_addr_hash),
                    &addr, sizeof (addr)) != PS_OK) {
                        return_val = TD_DBERR;
                        goto out;
                }
                hashaddr = addr;
#else
                return_val = TD_ERR;
                goto out;
#endif  /* _SYSCALL32 */
        }

        if (hashaddr == 0)
                return_val = TD_BADSH;
        else
                return_val = read_sync_stats(ta_p, hashaddr,
                    sh_p->sh_unique, &sync_stats);
        if (return_val != TD_OK)
                goto out;

        /*
         * We have the hash table entry.  Transfer the data to
         * the td_syncstats_t structure provided by the caller.
         */
        switch (sync_stats.un.type) {
        case TDB_MUTEX:
        {
                td_mutex_stats_t *msp = &ss_p->ss_un.mutex;

                ss_p->ss_info.si_type = TD_SYNC_MUTEX;
                ss_p->ss_info.si_size = sizeof (mutex_t);
                msp->mutex_lock =
                    sync_stats.un.mutex.mutex_lock;
                msp->mutex_sleep =
                    sync_stats.un.mutex.mutex_sleep;
                msp->mutex_sleep_time =
                    sync_stats.un.mutex.mutex_sleep_time;
                msp->mutex_hold_time =
                    sync_stats.un.mutex.mutex_hold_time;
                msp->mutex_try =
                    sync_stats.un.mutex.mutex_try;
                msp->mutex_try_fail =
                    sync_stats.un.mutex.mutex_try_fail;
                if (sync_stats.sync_addr >= ta_p->hash_table_addr &&
                    (ix = sync_stats.sync_addr - ta_p->hash_table_addr)
                    < ta_p->hash_size * sizeof (thr_hash_table_t))
                        msp->mutex_internal =
                            ix / sizeof (thr_hash_table_t) + 1;
                break;
        }
        case TDB_COND:
        {
                td_cond_stats_t *csp = &ss_p->ss_un.cond;

                ss_p->ss_info.si_type = TD_SYNC_COND;
                ss_p->ss_info.si_size = sizeof (cond_t);
                csp->cond_wait =
                    sync_stats.un.cond.cond_wait;
                csp->cond_timedwait =
                    sync_stats.un.cond.cond_timedwait;
                csp->cond_wait_sleep_time =
                    sync_stats.un.cond.cond_wait_sleep_time;
                csp->cond_timedwait_sleep_time =
                    sync_stats.un.cond.cond_timedwait_sleep_time;
                csp->cond_timedwait_timeout =
                    sync_stats.un.cond.cond_timedwait_timeout;
                csp->cond_signal =
                    sync_stats.un.cond.cond_signal;
                csp->cond_broadcast =
                    sync_stats.un.cond.cond_broadcast;
                if (sync_stats.sync_addr >= ta_p->hash_table_addr &&
                    (ix = sync_stats.sync_addr - ta_p->hash_table_addr)
                    < ta_p->hash_size * sizeof (thr_hash_table_t))
                        csp->cond_internal =
                            ix / sizeof (thr_hash_table_t) + 1;
                break;
        }
        case TDB_RWLOCK:
        {
                td_rwlock_stats_t *rwsp = &ss_p->ss_un.rwlock;

                ss_p->ss_info.si_type = TD_SYNC_RWLOCK;
                ss_p->ss_info.si_size = sizeof (rwlock_t);
                rwsp->rw_rdlock =
                    sync_stats.un.rwlock.rw_rdlock;
                rwsp->rw_rdlock_try =
                    sync_stats.un.rwlock.rw_rdlock_try;
                rwsp->rw_rdlock_try_fail =
                    sync_stats.un.rwlock.rw_rdlock_try_fail;
                rwsp->rw_wrlock =
                    sync_stats.un.rwlock.rw_wrlock;
                rwsp->rw_wrlock_hold_time =
                    sync_stats.un.rwlock.rw_wrlock_hold_time;
                rwsp->rw_wrlock_try =
                    sync_stats.un.rwlock.rw_wrlock_try;
                rwsp->rw_wrlock_try_fail =
                    sync_stats.un.rwlock.rw_wrlock_try_fail;
                break;
        }
        case TDB_SEMA:
        {
                td_sema_stats_t *ssp = &ss_p->ss_un.sema;

                ss_p->ss_info.si_type = TD_SYNC_SEMA;
                ss_p->ss_info.si_size = sizeof (sema_t);
                ssp->sema_wait =
                    sync_stats.un.sema.sema_wait;
                ssp->sema_wait_sleep =
                    sync_stats.un.sema.sema_wait_sleep;
                ssp->sema_wait_sleep_time =
                    sync_stats.un.sema.sema_wait_sleep_time;
                ssp->sema_trywait =
                    sync_stats.un.sema.sema_trywait;
                ssp->sema_trywait_fail =
                    sync_stats.un.sema.sema_trywait_fail;
                ssp->sema_post =
                    sync_stats.un.sema.sema_post;
                ssp->sema_max_count =
                    sync_stats.un.sema.sema_max_count;
                ssp->sema_min_count =
                    sync_stats.un.sema.sema_min_count;
                break;
        }
        default:
                return_val = TD_BADSH;
                break;
        }

out:
        (void) ps_pcontinue(ph_p);
        ph_unlock(ta_p);
        return (return_val);
}

/*
 * Change the state of a synchronization variable.
 *      1) mutex lock state set to value
 *      2) semaphore's count set to value
 *      3) writer's lock set by value < 0
 *      4) reader's lock number of readers set to value >= 0
 * Currently unused by dbx.
 */
#pragma weak td_sync_setstate = __td_sync_setstate
td_err_e
__td_sync_setstate(const td_synchandle_t *sh_p, int value)
{
        struct ps_prochandle *ph_p;
        int             trunc = 0;
        td_err_e        return_val;
        td_so_un_t      generic_so;
        uint32_t        *rwstate;

        if ((ph_p = ph_lock_sh(sh_p, &return_val)) == NULL)
                return (return_val);
        if (ps_pstop(ph_p) != PS_OK) {
                ph_unlock(sh_p->sh_ta_p);
                return (TD_DBERR);
        }

        /*
         * Read the synch. variable information.
         * First attempt to read the whole union and if that fails
         * fall back to reading only the smallest member, the condvar.
         */
        if (ps_pdread(ph_p, sh_p->sh_unique, &generic_so,
            sizeof (generic_so)) != PS_OK) {
                trunc = 1;
                if (ps_pdread(ph_p, sh_p->sh_unique, &generic_so.condition,
                    sizeof (generic_so.condition)) != PS_OK) {
                        (void) ps_pcontinue(ph_p);
                        ph_unlock(sh_p->sh_ta_p);
                        return (TD_DBERR);
                }
        }

        /*
         * Set the new value in the sync. variable, read the synch. variable
         * information. from the process, reset its value and write it back.
         */
        switch (generic_so.condition.mutex_magic) {
        case MUTEX_MAGIC:
                if (trunc && ps_pdread(ph_p, sh_p->sh_unique,
                    &generic_so.lock, sizeof (generic_so.lock)) != PS_OK) {
                        return_val = TD_DBERR;
                        break;
                }
                generic_so.lock.mutex_lockw = (uint8_t)value;
                if (ps_pdwrite(ph_p, sh_p->sh_unique, &generic_so.lock,
                    sizeof (generic_so.lock)) != PS_OK)
                        return_val = TD_DBERR;
                break;
        case SEMA_MAGIC:
                if (trunc && ps_pdread(ph_p, sh_p->sh_unique,
                    &generic_so.semaphore, sizeof (generic_so.semaphore))
                    != PS_OK) {
                        return_val = TD_DBERR;
                        break;
                }
                generic_so.semaphore.count = value;
                if (ps_pdwrite(ph_p, sh_p->sh_unique, &generic_so.semaphore,
                    sizeof (generic_so.semaphore)) != PS_OK)
                        return_val = TD_DBERR;
                break;
        case COND_MAGIC:
                /* Operation not supported on a condition variable */
                return_val = TD_ERR;
                break;
        case RWL_MAGIC:
                if (trunc && ps_pdread(ph_p, sh_p->sh_unique,
                    &generic_so.rwlock, sizeof (generic_so.rwlock)) != PS_OK) {
                        return_val = TD_DBERR;
                        break;
                }
                rwstate = (uint32_t *)&generic_so.rwlock.readers;
                *rwstate &= URW_HAS_WAITERS;
                if (value < 0)
                        *rwstate |= URW_WRITE_LOCKED;
                else
                        *rwstate |= (value & URW_READERS_MASK);
                if (ps_pdwrite(ph_p, sh_p->sh_unique, &generic_so.rwlock,
                    sizeof (generic_so.rwlock)) != PS_OK)
                        return_val = TD_DBERR;
                break;
        default:
                /* Bad sync. object type */
                return_val = TD_BADSH;
                break;
        }

        (void) ps_pcontinue(ph_p);
        ph_unlock(sh_p->sh_ta_p);
        return (return_val);
}

typedef struct {
        td_thr_iter_f   *waiter_cb;
        psaddr_t        sync_obj_addr;
        uint16_t        sync_magic;
        void            *waiter_cb_arg;
        td_err_e        errcode;
} waiter_cb_ctl_t;

static int
waiters_cb(const td_thrhandle_t *th_p, void *arg)
{
        td_thragent_t   *ta_p = th_p->th_ta_p;
        struct ps_prochandle *ph_p = ta_p->ph_p;
        waiter_cb_ctl_t *wcb = arg;
        caddr_t         wchan;

        if (ta_p->model == PR_MODEL_NATIVE) {
                ulwp_t *ulwp = (ulwp_t *)th_p->th_unique;

                if (ps_pdread(ph_p, (psaddr_t)&ulwp->ul_wchan,
                    &wchan, sizeof (wchan)) != PS_OK) {
                        wcb->errcode = TD_DBERR;
                        return (1);
                }
        } else {
#if defined(_LP64) && defined(_SYSCALL32)
                ulwp32_t *ulwp = (ulwp32_t *)th_p->th_unique;
                caddr32_t wchan32;

                if (ps_pdread(ph_p, (psaddr_t)&ulwp->ul_wchan,
                    &wchan32, sizeof (wchan32)) != PS_OK) {
                        wcb->errcode = TD_DBERR;
                        return (1);
                }
                wchan = (caddr_t)(uintptr_t)wchan32;
#else
                wcb->errcode = TD_ERR;
                return (1);
#endif  /* _SYSCALL32 */
        }

        if (wchan == NULL)
                return (0);

        if (wchan == (caddr_t)wcb->sync_obj_addr)
                return ((*wcb->waiter_cb)(th_p, wcb->waiter_cb_arg));

        return (0);
}

/*
 * For a given synchronization variable, iterate over the
 * set of waiting threads.  The call back function is passed
 * two parameters, a pointer to a thread handle and a pointer
 * to extra call back data.
 */
#pragma weak td_sync_waiters = __td_sync_waiters
td_err_e
__td_sync_waiters(const td_synchandle_t *sh_p, td_thr_iter_f *cb, void *cb_data)
{
        struct ps_prochandle *ph_p;
        waiter_cb_ctl_t wcb;
        td_err_e        return_val;

        if ((ph_p = ph_lock_sh(sh_p, &return_val)) == NULL)
                return (return_val);
        if (ps_pdread(ph_p,
            (psaddr_t)&((mutex_t *)sh_p->sh_unique)->mutex_magic,
            (caddr_t)&wcb.sync_magic, sizeof (wcb.sync_magic)) != PS_OK) {
                ph_unlock(sh_p->sh_ta_p);
                return (TD_DBERR);
        }
        ph_unlock(sh_p->sh_ta_p);

        switch (wcb.sync_magic) {
        case MUTEX_MAGIC:
        case COND_MAGIC:
        case SEMA_MAGIC:
        case RWL_MAGIC:
                break;
        default:
                return (TD_BADSH);
        }

        wcb.waiter_cb = cb;
        wcb.sync_obj_addr = sh_p->sh_unique;
        wcb.waiter_cb_arg = cb_data;
        wcb.errcode = TD_OK;
        return_val = __td_ta_thr_iter(sh_p->sh_ta_p, waiters_cb, &wcb,
            TD_THR_SLEEP, TD_THR_LOWEST_PRIORITY,
            TD_SIGNO_MASK, TD_THR_ANY_USER_FLAGS);

        if (return_val != TD_OK)
                return (return_val);

        return (wcb.errcode);
}