xref: /freebsd/sys/kern/subr_kdb.c (revision 1719886f6d08408b834d270c59ffcfd821c8f63a)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2004 The FreeBSD Project
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 #include "opt_kdb.h"
31 #include "opt_stack.h"
32 
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/cons.h>
36 #include <sys/kdb.h>
37 #include <sys/kernel.h>
38 #include <sys/malloc.h>
39 #include <sys/lock.h>
40 #include <sys/pcpu.h>
41 #include <sys/priv.h>
42 #include <sys/proc.h>
43 #include <sys/sbuf.h>
44 #include <sys/smp.h>
45 #include <sys/stack.h>
46 #include <sys/sysctl.h>
47 #include <sys/tslog.h>
48 
49 #include <machine/kdb.h>
50 #include <machine/pcb.h>
51 
52 #ifdef SMP
53 #include <machine/smp.h>
54 #endif
55 
56 #include <security/mac/mac_framework.h>
57 
58 u_char __read_frequently kdb_active = 0;
59 static void *kdb_jmpbufp = NULL;
60 struct kdb_dbbe *kdb_dbbe = NULL;
61 static struct pcb kdb_pcb;
62 struct pcb *kdb_thrctx = NULL;
63 struct thread *kdb_thread = NULL;
64 struct trapframe *kdb_frame = NULL;
65 
66 #ifdef BREAK_TO_DEBUGGER
67 #define	KDB_BREAK_TO_DEBUGGER	1
68 #else
69 #define	KDB_BREAK_TO_DEBUGGER	0
70 #endif
71 
72 #ifdef ALT_BREAK_TO_DEBUGGER
73 #define	KDB_ALT_BREAK_TO_DEBUGGER	1
74 #else
75 #define	KDB_ALT_BREAK_TO_DEBUGGER	0
76 #endif
77 
78 static int	kdb_break_to_debugger = KDB_BREAK_TO_DEBUGGER;
79 static int	kdb_alt_break_to_debugger = KDB_ALT_BREAK_TO_DEBUGGER;
80 static int	kdb_enter_securelevel = 0;
81 
82 KDB_BACKEND(null, NULL, NULL, NULL, NULL);
83 
84 static int kdb_sysctl_available(SYSCTL_HANDLER_ARGS);
85 static int kdb_sysctl_current(SYSCTL_HANDLER_ARGS);
86 static int kdb_sysctl_enter(SYSCTL_HANDLER_ARGS);
87 static int kdb_sysctl_panic(SYSCTL_HANDLER_ARGS);
88 static int kdb_sysctl_panic_str(SYSCTL_HANDLER_ARGS);
89 static int kdb_sysctl_trap(SYSCTL_HANDLER_ARGS);
90 static int kdb_sysctl_trap_code(SYSCTL_HANDLER_ARGS);
91 static int kdb_sysctl_stack_overflow(SYSCTL_HANDLER_ARGS);
92 
93 static SYSCTL_NODE(_debug, OID_AUTO, kdb, CTLFLAG_RW | CTLFLAG_MPSAFE, NULL,
94     "KDB nodes");
95 
96 SYSCTL_PROC(_debug_kdb, OID_AUTO, available,
97     CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
98     kdb_sysctl_available, "A",
99     "list of available KDB backends");
100 
101 SYSCTL_PROC(_debug_kdb, OID_AUTO, current,
102     CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, 0,
103     kdb_sysctl_current, "A",
104     "currently selected KDB backend");
105 
106 SYSCTL_PROC(_debug_kdb, OID_AUTO, enter,
107     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, 0,
108     kdb_sysctl_enter, "I",
109     "set to enter the debugger");
110 
111 SYSCTL_PROC(_debug_kdb, OID_AUTO, panic,
112     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_SECURE | CTLFLAG_MPSAFE, NULL, 0,
113     kdb_sysctl_panic, "I",
114     "set to panic the kernel");
115 
116 SYSCTL_PROC(_debug_kdb, OID_AUTO, panic_str,
117     CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_SECURE | CTLFLAG_MPSAFE, NULL, 0,
118     kdb_sysctl_panic_str, "A",
119     "trigger a kernel panic, using the provided string as the panic message");
120 
121 SYSCTL_PROC(_debug_kdb, OID_AUTO, trap,
122     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_SECURE | CTLFLAG_MPSAFE, NULL, 0,
123     kdb_sysctl_trap, "I",
124     "set to cause a page fault via data access");
125 
126 SYSCTL_PROC(_debug_kdb, OID_AUTO, trap_code,
127     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_SECURE | CTLFLAG_MPSAFE, NULL, 0,
128     kdb_sysctl_trap_code, "I",
129     "set to cause a page fault via code access");
130 
131 SYSCTL_PROC(_debug_kdb, OID_AUTO, stack_overflow,
132     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_SECURE | CTLFLAG_MPSAFE, NULL, 0,
133     kdb_sysctl_stack_overflow, "I",
134     "set to cause a stack overflow");
135 
136 SYSCTL_INT(_debug_kdb, OID_AUTO, break_to_debugger,
137     CTLFLAG_RWTUN,
138     &kdb_break_to_debugger, 0, "Enable break to debugger");
139 
140 SYSCTL_INT(_debug_kdb, OID_AUTO, alt_break_to_debugger,
141     CTLFLAG_RWTUN,
142     &kdb_alt_break_to_debugger, 0, "Enable alternative break to debugger");
143 
144 SYSCTL_INT(_debug_kdb, OID_AUTO, enter_securelevel,
145     CTLFLAG_RWTUN | CTLFLAG_SECURE,
146     &kdb_enter_securelevel, 0,
147     "Maximum securelevel to enter a KDB backend");
148 
149 /*
150  * Flag to indicate to debuggers why the debugger was entered.
151  */
152 const char * volatile kdb_why = KDB_WHY_UNSET;
153 
154 static int
155 kdb_sysctl_available(SYSCTL_HANDLER_ARGS)
156 {
157 	struct kdb_dbbe **iter;
158 	struct sbuf sbuf;
159 	int error;
160 
161 	sbuf_new_for_sysctl(&sbuf, NULL, 64, req);
162 	SET_FOREACH(iter, kdb_dbbe_set) {
163 		if ((*iter)->dbbe_active == 0)
164 			sbuf_printf(&sbuf, "%s ", (*iter)->dbbe_name);
165 	}
166 	error = sbuf_finish(&sbuf);
167 	sbuf_delete(&sbuf);
168 	return (error);
169 }
170 
171 static int
172 kdb_sysctl_current(SYSCTL_HANDLER_ARGS)
173 {
174 	char buf[16];
175 	int error;
176 
177 	if (kdb_dbbe != NULL)
178 		strlcpy(buf, kdb_dbbe->dbbe_name, sizeof(buf));
179 	else
180 		*buf = '\0';
181 	error = sysctl_handle_string(oidp, buf, sizeof(buf), req);
182 	if (error != 0 || req->newptr == NULL)
183 		return (error);
184 	if (kdb_active)
185 		return (EBUSY);
186 	return (kdb_dbbe_select(buf));
187 }
188 
189 static int
190 kdb_sysctl_enter(SYSCTL_HANDLER_ARGS)
191 {
192 	int error, i;
193 
194 	error = sysctl_wire_old_buffer(req, sizeof(int));
195 	if (error == 0) {
196 		i = 0;
197 		error = sysctl_handle_int(oidp, &i, 0, req);
198 	}
199 	if (error != 0 || req->newptr == NULL)
200 		return (error);
201 	if (kdb_active)
202 		return (EBUSY);
203 	kdb_enter(KDB_WHY_SYSCTL, "sysctl debug.kdb.enter");
204 	return (0);
205 }
206 
207 static int
208 kdb_sysctl_panic(SYSCTL_HANDLER_ARGS)
209 {
210 	int error, i;
211 
212 	error = sysctl_wire_old_buffer(req, sizeof(int));
213 	if (error == 0) {
214 		i = 0;
215 		error = sysctl_handle_int(oidp, &i, 0, req);
216 	}
217 	if (error != 0 || req->newptr == NULL)
218 		return (error);
219 	panic("kdb_sysctl_panic");
220 	return (0);
221 }
222 
223 static int
224 kdb_sysctl_panic_str(SYSCTL_HANDLER_ARGS)
225 {
226 	int error;
227 	static char buf[256]; /* static buffer to limit mallocs when panicing */
228 
229 	*buf = '\0';
230 	error = sysctl_handle_string(oidp, buf, sizeof(buf), req);
231 	if (error != 0 || req->newptr == NULL)
232 		return (error);
233 	panic("kdb_sysctl_panic: %s", buf);
234 	return (0);
235 }
236 
237 static int
238 kdb_sysctl_trap(SYSCTL_HANDLER_ARGS)
239 {
240 	int error, i;
241 	int *addr = (int *)0x10;
242 
243 	error = sysctl_wire_old_buffer(req, sizeof(int));
244 	if (error == 0) {
245 		i = 0;
246 		error = sysctl_handle_int(oidp, &i, 0, req);
247 	}
248 	if (error != 0 || req->newptr == NULL)
249 		return (error);
250 	return (*addr);
251 }
252 
253 static int
254 kdb_sysctl_trap_code(SYSCTL_HANDLER_ARGS)
255 {
256 	int error, i;
257 	void (*fp)(u_int, u_int, u_int) = (void *)0xdeadc0de;
258 
259 	error = sysctl_wire_old_buffer(req, sizeof(int));
260 	if (error == 0) {
261 		i = 0;
262 		error = sysctl_handle_int(oidp, &i, 0, req);
263 	}
264 	if (error != 0 || req->newptr == NULL)
265 		return (error);
266 	(*fp)(0x11111111, 0x22222222, 0x33333333);
267 	return (0);
268 }
269 
270 static void kdb_stack_overflow(volatile int *x)  __noinline;
271 static void
272 kdb_stack_overflow(volatile int *x)
273 {
274 
275 	if (*x > 10000000)
276 		return;
277 	kdb_stack_overflow(x);
278 	*x += PCPU_GET(cpuid) / 1000000;
279 }
280 
281 static int
282 kdb_sysctl_stack_overflow(SYSCTL_HANDLER_ARGS)
283 {
284 	int error, i;
285 	volatile int x;
286 
287 	error = sysctl_wire_old_buffer(req, sizeof(int));
288 	if (error == 0) {
289 		i = 0;
290 		error = sysctl_handle_int(oidp, &i, 0, req);
291 	}
292 	if (error != 0 || req->newptr == NULL)
293 		return (error);
294 	x = 0;
295 	kdb_stack_overflow(&x);
296 	return (0);
297 }
298 
299 void
300 kdb_panic(const char *msg)
301 {
302 
303 	kdb_why = KDB_WHY_PANIC;
304 	printf("KDB: panic\n");
305 	panic("%s", msg);
306 }
307 
308 void
309 kdb_reboot(void)
310 {
311 
312 	kdb_why = KDB_WHY_REBOOT;
313 	printf("KDB: reboot requested\n");
314 	shutdown_nice(0);
315 }
316 
317 /*
318  * Solaris implements a new BREAK which is initiated by a character sequence
319  * CR ~ ^b which is similar to a familiar pattern used on Sun servers by the
320  * Remote Console.
321  *
322  * Note that this function may be called from almost anywhere, with interrupts
323  * disabled and with unknown locks held, so it must not access data other than
324  * its arguments.  Its up to the caller to ensure that the state variable is
325  * consistent.
326  */
327 #define	KEY_CR		13	/* CR '\r' */
328 #define	KEY_TILDE	126	/* ~ */
329 #define	KEY_CRTLB	2	/* ^B */
330 #define	KEY_CRTLP	16	/* ^P */
331 #define	KEY_CRTLR	18	/* ^R */
332 
333 /* States of th KDB "alternate break sequence" detecting state machine. */
334 enum {
335 	KDB_ALT_BREAK_SEEN_NONE,
336 	KDB_ALT_BREAK_SEEN_CR,
337 	KDB_ALT_BREAK_SEEN_CR_TILDE,
338 };
339 
340 int
341 kdb_break(void)
342 {
343 
344 	if (!kdb_break_to_debugger)
345 		return (0);
346 	kdb_enter(KDB_WHY_BREAK, "Break to debugger");
347 	return (KDB_REQ_DEBUGGER);
348 }
349 
350 static int
351 kdb_alt_break_state(int key, int *state)
352 {
353 	int brk;
354 
355 	/* All states transition to KDB_ALT_BREAK_SEEN_CR on a CR. */
356 	if (key == KEY_CR) {
357 		*state = KDB_ALT_BREAK_SEEN_CR;
358 		return (0);
359 	}
360 
361 	brk = 0;
362 	switch (*state) {
363 	case KDB_ALT_BREAK_SEEN_CR:
364 		*state = KDB_ALT_BREAK_SEEN_NONE;
365 		if (key == KEY_TILDE)
366 			*state = KDB_ALT_BREAK_SEEN_CR_TILDE;
367 		break;
368 	case KDB_ALT_BREAK_SEEN_CR_TILDE:
369 		*state = KDB_ALT_BREAK_SEEN_NONE;
370 		if (key == KEY_CRTLB)
371 			brk = KDB_REQ_DEBUGGER;
372 		else if (key == KEY_CRTLP)
373 			brk = KDB_REQ_PANIC;
374 		else if (key == KEY_CRTLR)
375 			brk = KDB_REQ_REBOOT;
376 		break;
377 	case KDB_ALT_BREAK_SEEN_NONE:
378 	default:
379 		*state = KDB_ALT_BREAK_SEEN_NONE;
380 		break;
381 	}
382 	return (brk);
383 }
384 
385 static int
386 kdb_alt_break_internal(int key, int *state, int force_gdb)
387 {
388 	int brk;
389 
390 	if (!kdb_alt_break_to_debugger)
391 		return (0);
392 	brk = kdb_alt_break_state(key, state);
393 	switch (brk) {
394 	case KDB_REQ_DEBUGGER:
395 		if (force_gdb)
396 			kdb_dbbe_select("gdb");
397 		kdb_enter(KDB_WHY_BREAK, "Break to debugger");
398 		break;
399 
400 	case KDB_REQ_PANIC:
401 		if (force_gdb)
402 			kdb_dbbe_select("gdb");
403 		kdb_panic("Panic sequence on console");
404 		break;
405 
406 	case KDB_REQ_REBOOT:
407 		kdb_reboot();
408 		break;
409 	}
410 	return (0);
411 }
412 
413 int
414 kdb_alt_break(int key, int *state)
415 {
416 
417 	return (kdb_alt_break_internal(key, state, 0));
418 }
419 
420 /*
421  * This variation on kdb_alt_break() is used only by dcons, which has its own
422  * configuration flag to force GDB use regardless of the global KDB
423  * configuration.
424  */
425 int
426 kdb_alt_break_gdb(int key, int *state)
427 {
428 
429 	return (kdb_alt_break_internal(key, state, 1));
430 }
431 
432 /*
433  * Print a backtrace of the calling thread. The backtrace is generated by
434  * the selected debugger, provided it supports backtraces. If no debugger
435  * is selected or the current debugger does not support backtraces, this
436  * function silently returns.
437  */
438 void
439 kdb_backtrace(void)
440 {
441 
442 	if (kdb_dbbe != NULL && kdb_dbbe->dbbe_trace != NULL) {
443 		printf("KDB: stack backtrace:\n");
444 		kdb_dbbe->dbbe_trace();
445 	}
446 #ifdef STACK
447 	else {
448 		struct stack st;
449 
450 		printf("KDB: stack backtrace:\n");
451 		stack_save(&st);
452 		stack_print_ddb(&st);
453 	}
454 #endif
455 }
456 
457 /*
458  * Similar to kdb_backtrace() except that it prints a backtrace of an
459  * arbitrary thread rather than the calling thread.
460  */
461 void
462 kdb_backtrace_thread(struct thread *td)
463 {
464 
465 	if (kdb_dbbe != NULL && kdb_dbbe->dbbe_trace_thread != NULL) {
466 		printf("KDB: stack backtrace of thread %d:\n", td->td_tid);
467 		kdb_dbbe->dbbe_trace_thread(td);
468 	}
469 #ifdef STACK
470 	else {
471 		struct stack st;
472 
473 		printf("KDB: stack backtrace of thread %d:\n", td->td_tid);
474 		if (stack_save_td(&st, td) == 0)
475 			stack_print_ddb(&st);
476 	}
477 #endif
478 }
479 
480 /*
481  * Set/change the current backend.
482  */
483 int
484 kdb_dbbe_select(const char *name)
485 {
486 	struct kdb_dbbe *be, **iter;
487 	int error;
488 
489 	error = priv_check(curthread, PRIV_KDB_SET_BACKEND);
490 	if (error)
491 		return (error);
492 
493 	SET_FOREACH(iter, kdb_dbbe_set) {
494 		be = *iter;
495 		if (be->dbbe_active == 0 && strcmp(be->dbbe_name, name) == 0) {
496 			kdb_dbbe = be;
497 			return (0);
498 		}
499 	}
500 	return (EINVAL);
501 }
502 
503 static bool
504 kdb_backend_permitted(struct kdb_dbbe *be, struct thread *td)
505 {
506 	struct ucred *cred;
507 	int error;
508 
509 	cred = td->td_ucred;
510 	if (cred == NULL) {
511 		KASSERT(td == &thread0 && cold,
512 		    ("%s: missing cred for %p", __func__, td));
513 		error = 0;
514 	} else {
515 		error = securelevel_gt(cred, kdb_enter_securelevel);
516 	}
517 #ifdef MAC
518 	/*
519 	 * Give MAC a chance to weigh in on the policy: if the securelevel is
520 	 * not raised, then MAC may veto the backend, otherwise MAC may
521 	 * explicitly grant access.
522 	 */
523 	if (error == 0) {
524 		error = mac_kdb_check_backend(be);
525 		if (error != 0) {
526 			printf("MAC prevented execution of KDB backend: %s\n",
527 			    be->dbbe_name);
528 			return (false);
529 		}
530 	} else if (mac_kdb_grant_backend(be) == 0) {
531 		error = 0;
532 	}
533 #endif
534 	if (error != 0)
535 		printf("refusing to enter KDB with elevated securelevel\n");
536 	return (error == 0);
537 }
538 
539 /*
540  * Enter the currently selected debugger. If a message has been provided,
541  * it is printed first. If the debugger does not support the enter method,
542  * it is entered by using breakpoint(), which enters the debugger through
543  * kdb_trap().  The 'why' argument will contain a more mechanically usable
544  * string than 'msg', and is relied upon by DDB scripting to identify the
545  * reason for entering the debugger so that the right script can be run.
546  */
547 void
548 kdb_enter(const char *why, const char *msg)
549 {
550 
551 	if (kdb_dbbe != NULL && kdb_active == 0) {
552 		kdb_why = why;
553 		if (msg != NULL)
554 			printf("KDB: enter: %s\n", msg);
555 		breakpoint();
556 		kdb_why = KDB_WHY_UNSET;
557 	}
558 }
559 
560 /*
561  * Initialize the kernel debugger interface.
562  */
563 void
564 kdb_init(void)
565 {
566 	struct kdb_dbbe *be, **iter;
567 	int cur_pri, pri;
568 
569 	TSENTER();
570 	kdb_active = 0;
571 	kdb_dbbe = NULL;
572 	cur_pri = -1;
573 	SET_FOREACH(iter, kdb_dbbe_set) {
574 		be = *iter;
575 		pri = (be->dbbe_init != NULL) ? be->dbbe_init() : -1;
576 		be->dbbe_active = (pri >= 0) ? 0 : -1;
577 		if (pri > cur_pri) {
578 			cur_pri = pri;
579 			kdb_dbbe = be;
580 		}
581 	}
582 	if (kdb_dbbe != NULL) {
583 		printf("KDB: debugger backends:");
584 		SET_FOREACH(iter, kdb_dbbe_set) {
585 			be = *iter;
586 			if (be->dbbe_active == 0)
587 				printf(" %s", be->dbbe_name);
588 		}
589 		printf("\n");
590 		printf("KDB: current backend: %s\n",
591 		    kdb_dbbe->dbbe_name);
592 	}
593 	TSEXIT();
594 }
595 
596 /*
597  * Handle contexts.
598  */
599 void *
600 kdb_jmpbuf(jmp_buf new)
601 {
602 	void *old;
603 
604 	old = kdb_jmpbufp;
605 	kdb_jmpbufp = new;
606 	return (old);
607 }
608 
609 void
610 kdb_reenter(void)
611 {
612 
613 	if (!kdb_active || kdb_jmpbufp == NULL)
614 		return;
615 
616 	printf("KDB: reentering\n");
617 	kdb_backtrace();
618 	longjmp(kdb_jmpbufp, 1);
619 	/* NOTREACHED */
620 }
621 
622 void
623 kdb_reenter_silent(void)
624 {
625 
626 	if (!kdb_active || kdb_jmpbufp == NULL)
627 		return;
628 
629 	longjmp(kdb_jmpbufp, 1);
630 	/* NOTREACHED */
631 }
632 
633 /*
634  * Thread-related support functions.
635  */
636 struct pcb *
637 kdb_thr_ctx(struct thread *thr)
638 {
639 #ifdef SMP
640 	struct pcpu *pc;
641 #endif
642 
643 	if (thr == curthread)
644 		return (&kdb_pcb);
645 
646 #ifdef SMP
647 	STAILQ_FOREACH(pc, &cpuhead, pc_allcpu)  {
648 		if (pc->pc_curthread == thr &&
649 		    CPU_ISSET(pc->pc_cpuid, &stopped_cpus))
650 			return (&stoppcbs[pc->pc_cpuid]);
651 	}
652 #endif
653 	return (thr->td_pcb);
654 }
655 
656 struct thread *
657 kdb_thr_first(void)
658 {
659 	struct proc *p;
660 	struct thread *thr;
661 	u_int i;
662 
663 	/* This function may be called early. */
664 	if (pidhashtbl == NULL)
665 		return (&thread0);
666 
667 	for (i = 0; i <= pidhash; i++) {
668 		LIST_FOREACH(p, &pidhashtbl[i], p_hash) {
669 			thr = FIRST_THREAD_IN_PROC(p);
670 			if (thr != NULL)
671 				return (thr);
672 		}
673 	}
674 	return (NULL);
675 }
676 
677 struct thread *
678 kdb_thr_from_pid(pid_t pid)
679 {
680 	struct proc *p;
681 
682 	LIST_FOREACH(p, PIDHASH(pid), p_hash) {
683 		if (p->p_pid == pid)
684 			return (FIRST_THREAD_IN_PROC(p));
685 	}
686 	return (NULL);
687 }
688 
689 struct thread *
690 kdb_thr_lookup(lwpid_t tid)
691 {
692 	struct thread *thr;
693 
694 	thr = kdb_thr_first();
695 	while (thr != NULL && thr->td_tid != tid)
696 		thr = kdb_thr_next(thr);
697 	return (thr);
698 }
699 
700 struct thread *
701 kdb_thr_next(struct thread *thr)
702 {
703 	struct proc *p;
704 	u_int hash;
705 
706 	p = thr->td_proc;
707 	thr = TAILQ_NEXT(thr, td_plist);
708 	if (thr != NULL)
709 		return (thr);
710 	if (pidhashtbl == NULL)
711 		return (NULL);
712 	hash = p->p_pid & pidhash;
713 	for (;;) {
714 		p = LIST_NEXT(p, p_hash);
715 		while (p == NULL) {
716 			if (++hash > pidhash)
717 				return (NULL);
718 			p = LIST_FIRST(&pidhashtbl[hash]);
719 		}
720 		thr = FIRST_THREAD_IN_PROC(p);
721 		if (thr != NULL)
722 			return (thr);
723 	}
724 }
725 
726 int
727 kdb_thr_select(struct thread *thr)
728 {
729 	if (thr == NULL)
730 		return (EINVAL);
731 	kdb_thread = thr;
732 	kdb_thrctx = kdb_thr_ctx(thr);
733 	return (0);
734 }
735 
736 /*
737  * Enter the debugger due to a trap.
738  */
739 int
740 kdb_trap(int type, int code, struct trapframe *tf)
741 {
742 #ifdef SMP
743 	cpuset_t other_cpus;
744 #endif
745 	struct kdb_dbbe *be;
746 	register_t intr;
747 	int handled;
748 	int did_stop_cpus;
749 
750 	be = kdb_dbbe;
751 	if (be == NULL || be->dbbe_trap == NULL)
752 		return (0);
753 
754 	/* We reenter the debugger through kdb_reenter(). */
755 	if (kdb_active)
756 		return (0);
757 
758 	intr = intr_disable();
759 
760 	if (!SCHEDULER_STOPPED()) {
761 #ifdef SMP
762 		other_cpus = all_cpus;
763 		CPU_ANDNOT(&other_cpus, &other_cpus, &stopped_cpus);
764 		CPU_CLR(PCPU_GET(cpuid), &other_cpus);
765 		stop_cpus_hard(other_cpus);
766 #endif
767 		scheduler_stopped = true;
768 		did_stop_cpus = 1;
769 	} else
770 		did_stop_cpus = 0;
771 
772 	kdb_active++;
773 
774 	kdb_frame = tf;
775 
776 	/* Let MD code do its thing first... */
777 	kdb_cpu_trap(type, code);
778 
779 	makectx(tf, &kdb_pcb);
780 	kdb_thr_select(curthread);
781 
782 	cngrab();
783 
784 	for (;;) {
785 		if (!kdb_backend_permitted(be, curthread)) {
786 			/* Unhandled breakpoint traps are fatal. */
787 			handled = 1;
788 			break;
789 		}
790 		handled = be->dbbe_trap(type, code);
791 		if (be == kdb_dbbe)
792 			break;
793 		be = kdb_dbbe;
794 		if (be == NULL || be->dbbe_trap == NULL)
795 			break;
796 		printf("Switching to %s back-end\n", be->dbbe_name);
797 	}
798 
799 	cnungrab();
800 
801 	kdb_active--;
802 
803 	if (did_stop_cpus) {
804 		scheduler_stopped = false;
805 #ifdef SMP
806 		CPU_AND(&other_cpus, &other_cpus, &stopped_cpus);
807 		restart_cpus(other_cpus);
808 #endif
809 	}
810 
811 	intr_restore(intr);
812 
813 	return (handled);
814 }
815