xref: /freebsd/sys/kern/subr_kdb.c (revision fee65b7e21eeeb625dcaba8cf2b9e0cf5af83498)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2004 The FreeBSD Project
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
31 
32 #include "opt_kdb.h"
33 #include "opt_stack.h"
34 
35 #include <sys/param.h>
36 #include <sys/systm.h>
37 #include <sys/cons.h>
38 #include <sys/kdb.h>
39 #include <sys/kernel.h>
40 #include <sys/malloc.h>
41 #include <sys/lock.h>
42 #include <sys/pcpu.h>
43 #include <sys/proc.h>
44 #include <sys/sbuf.h>
45 #include <sys/smp.h>
46 #include <sys/stack.h>
47 #include <sys/sysctl.h>
48 
49 #include <machine/kdb.h>
50 #include <machine/pcb.h>
51 
52 #ifdef SMP
53 #include <machine/smp.h>
54 #endif
55 
56 #include <security/mac/mac_framework.h>
57 
58 u_char __read_frequently kdb_active = 0;
59 static void *kdb_jmpbufp = NULL;
60 struct kdb_dbbe *kdb_dbbe = NULL;
61 static struct pcb kdb_pcb;
62 struct pcb *kdb_thrctx = NULL;
63 struct thread *kdb_thread = NULL;
64 struct trapframe *kdb_frame = NULL;
65 
66 #ifdef BREAK_TO_DEBUGGER
67 #define	KDB_BREAK_TO_DEBUGGER	1
68 #else
69 #define	KDB_BREAK_TO_DEBUGGER	0
70 #endif
71 
72 #ifdef ALT_BREAK_TO_DEBUGGER
73 #define	KDB_ALT_BREAK_TO_DEBUGGER	1
74 #else
75 #define	KDB_ALT_BREAK_TO_DEBUGGER	0
76 #endif
77 
78 static int	kdb_break_to_debugger = KDB_BREAK_TO_DEBUGGER;
79 static int	kdb_alt_break_to_debugger = KDB_ALT_BREAK_TO_DEBUGGER;
80 static int	kdb_enter_securelevel = 0;
81 
82 KDB_BACKEND(null, NULL, NULL, NULL, NULL);
83 
84 static int kdb_sysctl_available(SYSCTL_HANDLER_ARGS);
85 static int kdb_sysctl_current(SYSCTL_HANDLER_ARGS);
86 static int kdb_sysctl_enter(SYSCTL_HANDLER_ARGS);
87 static int kdb_sysctl_panic(SYSCTL_HANDLER_ARGS);
88 static int kdb_sysctl_panic_str(SYSCTL_HANDLER_ARGS);
89 static int kdb_sysctl_trap(SYSCTL_HANDLER_ARGS);
90 static int kdb_sysctl_trap_code(SYSCTL_HANDLER_ARGS);
91 static int kdb_sysctl_stack_overflow(SYSCTL_HANDLER_ARGS);
92 
93 static SYSCTL_NODE(_debug, OID_AUTO, kdb, CTLFLAG_RW | CTLFLAG_MPSAFE, NULL,
94     "KDB nodes");
95 
96 SYSCTL_PROC(_debug_kdb, OID_AUTO, available,
97     CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
98     kdb_sysctl_available, "A",
99     "list of available KDB backends");
100 
101 SYSCTL_PROC(_debug_kdb, OID_AUTO, current,
102     CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, 0,
103     kdb_sysctl_current, "A",
104     "currently selected KDB backend");
105 
106 SYSCTL_PROC(_debug_kdb, OID_AUTO, enter,
107     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, 0,
108     kdb_sysctl_enter, "I",
109     "set to enter the debugger");
110 
111 SYSCTL_PROC(_debug_kdb, OID_AUTO, panic,
112     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_SECURE | CTLFLAG_MPSAFE, NULL, 0,
113     kdb_sysctl_panic, "I",
114     "set to panic the kernel");
115 
116 SYSCTL_PROC(_debug_kdb, OID_AUTO, panic_str,
117     CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_SECURE | CTLFLAG_MPSAFE, NULL, 0,
118     kdb_sysctl_panic_str, "A",
119     "trigger a kernel panic, using the provided string as the panic message");
120 
121 SYSCTL_PROC(_debug_kdb, OID_AUTO, trap,
122     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_SECURE | CTLFLAG_MPSAFE, NULL, 0,
123     kdb_sysctl_trap, "I",
124     "set to cause a page fault via data access");
125 
126 SYSCTL_PROC(_debug_kdb, OID_AUTO, trap_code,
127     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_SECURE | CTLFLAG_MPSAFE, NULL, 0,
128     kdb_sysctl_trap_code, "I",
129     "set to cause a page fault via code access");
130 
131 SYSCTL_PROC(_debug_kdb, OID_AUTO, stack_overflow,
132     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_SECURE | CTLFLAG_MPSAFE, NULL, 0,
133     kdb_sysctl_stack_overflow, "I",
134     "set to cause a stack overflow");
135 
136 SYSCTL_INT(_debug_kdb, OID_AUTO, break_to_debugger,
137     CTLFLAG_RWTUN,
138     &kdb_break_to_debugger, 0, "Enable break to debugger");
139 
140 SYSCTL_INT(_debug_kdb, OID_AUTO, alt_break_to_debugger,
141     CTLFLAG_RWTUN,
142     &kdb_alt_break_to_debugger, 0, "Enable alternative break to debugger");
143 
144 SYSCTL_INT(_debug_kdb, OID_AUTO, enter_securelevel,
145     CTLFLAG_RWTUN | CTLFLAG_SECURE,
146     &kdb_enter_securelevel, 0,
147     "Maximum securelevel to enter a KDB backend");
148 
149 /*
150  * Flag to indicate to debuggers why the debugger was entered.
151  */
152 const char * volatile kdb_why = KDB_WHY_UNSET;
153 
154 static int
155 kdb_sysctl_available(SYSCTL_HANDLER_ARGS)
156 {
157 	struct kdb_dbbe **iter;
158 	struct sbuf sbuf;
159 	int error;
160 
161 	sbuf_new_for_sysctl(&sbuf, NULL, 64, req);
162 	SET_FOREACH(iter, kdb_dbbe_set) {
163 		if ((*iter)->dbbe_active == 0)
164 			sbuf_printf(&sbuf, "%s ", (*iter)->dbbe_name);
165 	}
166 	error = sbuf_finish(&sbuf);
167 	sbuf_delete(&sbuf);
168 	return (error);
169 }
170 
171 static int
172 kdb_sysctl_current(SYSCTL_HANDLER_ARGS)
173 {
174 	char buf[16];
175 	int error;
176 
177 	if (kdb_dbbe != NULL)
178 		strlcpy(buf, kdb_dbbe->dbbe_name, sizeof(buf));
179 	else
180 		*buf = '\0';
181 	error = sysctl_handle_string(oidp, buf, sizeof(buf), req);
182 	if (error != 0 || req->newptr == NULL)
183 		return (error);
184 	if (kdb_active)
185 		return (EBUSY);
186 	return (kdb_dbbe_select(buf));
187 }
188 
189 static int
190 kdb_sysctl_enter(SYSCTL_HANDLER_ARGS)
191 {
192 	int error, i;
193 
194 	error = sysctl_wire_old_buffer(req, sizeof(int));
195 	if (error == 0) {
196 		i = 0;
197 		error = sysctl_handle_int(oidp, &i, 0, req);
198 	}
199 	if (error != 0 || req->newptr == NULL)
200 		return (error);
201 	if (kdb_active)
202 		return (EBUSY);
203 	kdb_enter(KDB_WHY_SYSCTL, "sysctl debug.kdb.enter");
204 	return (0);
205 }
206 
207 static int
208 kdb_sysctl_panic(SYSCTL_HANDLER_ARGS)
209 {
210 	int error, i;
211 
212 	error = sysctl_wire_old_buffer(req, sizeof(int));
213 	if (error == 0) {
214 		i = 0;
215 		error = sysctl_handle_int(oidp, &i, 0, req);
216 	}
217 	if (error != 0 || req->newptr == NULL)
218 		return (error);
219 	panic("kdb_sysctl_panic");
220 	return (0);
221 }
222 
223 static int
224 kdb_sysctl_panic_str(SYSCTL_HANDLER_ARGS)
225 {
226 	int error;
227 	static char buf[256]; /* static buffer to limit mallocs when panicing */
228 
229 	*buf = '\0';
230 	error = sysctl_handle_string(oidp, buf, sizeof(buf), req);
231 	if (error != 0 || req->newptr == NULL)
232 		return (error);
233 	panic("kdb_sysctl_panic: %s", buf);
234 	return (0);
235 }
236 
237 static int
238 kdb_sysctl_trap(SYSCTL_HANDLER_ARGS)
239 {
240 	int error, i;
241 	int *addr = (int *)0x10;
242 
243 	error = sysctl_wire_old_buffer(req, sizeof(int));
244 	if (error == 0) {
245 		i = 0;
246 		error = sysctl_handle_int(oidp, &i, 0, req);
247 	}
248 	if (error != 0 || req->newptr == NULL)
249 		return (error);
250 	return (*addr);
251 }
252 
253 static int
254 kdb_sysctl_trap_code(SYSCTL_HANDLER_ARGS)
255 {
256 	int error, i;
257 	void (*fp)(u_int, u_int, u_int) = (void *)0xdeadc0de;
258 
259 	error = sysctl_wire_old_buffer(req, sizeof(int));
260 	if (error == 0) {
261 		i = 0;
262 		error = sysctl_handle_int(oidp, &i, 0, req);
263 	}
264 	if (error != 0 || req->newptr == NULL)
265 		return (error);
266 	(*fp)(0x11111111, 0x22222222, 0x33333333);
267 	return (0);
268 }
269 
270 static void kdb_stack_overflow(volatile int *x)  __noinline;
271 static void
272 kdb_stack_overflow(volatile int *x)
273 {
274 
275 	if (*x > 10000000)
276 		return;
277 	kdb_stack_overflow(x);
278 	*x += PCPU_GET(cpuid) / 1000000;
279 }
280 
281 static int
282 kdb_sysctl_stack_overflow(SYSCTL_HANDLER_ARGS)
283 {
284 	int error, i;
285 	volatile int x;
286 
287 	error = sysctl_wire_old_buffer(req, sizeof(int));
288 	if (error == 0) {
289 		i = 0;
290 		error = sysctl_handle_int(oidp, &i, 0, req);
291 	}
292 	if (error != 0 || req->newptr == NULL)
293 		return (error);
294 	x = 0;
295 	kdb_stack_overflow(&x);
296 	return (0);
297 }
298 
299 void
300 kdb_panic(const char *msg)
301 {
302 
303 	kdb_why = KDB_WHY_PANIC;
304 	printf("KDB: panic\n");
305 	panic("%s", msg);
306 }
307 
308 void
309 kdb_reboot(void)
310 {
311 
312 	kdb_why = KDB_WHY_REBOOT;
313 	printf("KDB: reboot requested\n");
314 	shutdown_nice(0);
315 }
316 
317 /*
318  * Solaris implements a new BREAK which is initiated by a character sequence
319  * CR ~ ^b which is similar to a familiar pattern used on Sun servers by the
320  * Remote Console.
321  *
322  * Note that this function may be called from almost anywhere, with interrupts
323  * disabled and with unknown locks held, so it must not access data other than
324  * its arguments.  Its up to the caller to ensure that the state variable is
325  * consistent.
326  */
327 #define	KEY_CR		13	/* CR '\r' */
328 #define	KEY_TILDE	126	/* ~ */
329 #define	KEY_CRTLB	2	/* ^B */
330 #define	KEY_CRTLP	16	/* ^P */
331 #define	KEY_CRTLR	18	/* ^R */
332 
333 /* States of th KDB "alternate break sequence" detecting state machine. */
334 enum {
335 	KDB_ALT_BREAK_SEEN_NONE,
336 	KDB_ALT_BREAK_SEEN_CR,
337 	KDB_ALT_BREAK_SEEN_CR_TILDE,
338 };
339 
340 int
341 kdb_break(void)
342 {
343 
344 	if (!kdb_break_to_debugger)
345 		return (0);
346 	kdb_enter(KDB_WHY_BREAK, "Break to debugger");
347 	return (KDB_REQ_DEBUGGER);
348 }
349 
350 static int
351 kdb_alt_break_state(int key, int *state)
352 {
353 	int brk;
354 
355 	/* All states transition to KDB_ALT_BREAK_SEEN_CR on a CR. */
356 	if (key == KEY_CR) {
357 		*state = KDB_ALT_BREAK_SEEN_CR;
358 		return (0);
359 	}
360 
361 	brk = 0;
362 	switch (*state) {
363 	case KDB_ALT_BREAK_SEEN_CR:
364 		*state = KDB_ALT_BREAK_SEEN_NONE;
365 		if (key == KEY_TILDE)
366 			*state = KDB_ALT_BREAK_SEEN_CR_TILDE;
367 		break;
368 	case KDB_ALT_BREAK_SEEN_CR_TILDE:
369 		*state = KDB_ALT_BREAK_SEEN_NONE;
370 		if (key == KEY_CRTLB)
371 			brk = KDB_REQ_DEBUGGER;
372 		else if (key == KEY_CRTLP)
373 			brk = KDB_REQ_PANIC;
374 		else if (key == KEY_CRTLR)
375 			brk = KDB_REQ_REBOOT;
376 		break;
377 	case KDB_ALT_BREAK_SEEN_NONE:
378 	default:
379 		*state = KDB_ALT_BREAK_SEEN_NONE;
380 		break;
381 	}
382 	return (brk);
383 }
384 
385 static int
386 kdb_alt_break_internal(int key, int *state, int force_gdb)
387 {
388 	int brk;
389 
390 	if (!kdb_alt_break_to_debugger)
391 		return (0);
392 	brk = kdb_alt_break_state(key, state);
393 	switch (brk) {
394 	case KDB_REQ_DEBUGGER:
395 		if (force_gdb)
396 			kdb_dbbe_select("gdb");
397 		kdb_enter(KDB_WHY_BREAK, "Break to debugger");
398 		break;
399 
400 	case KDB_REQ_PANIC:
401 		if (force_gdb)
402 			kdb_dbbe_select("gdb");
403 		kdb_panic("Panic sequence on console");
404 		break;
405 
406 	case KDB_REQ_REBOOT:
407 		kdb_reboot();
408 		break;
409 	}
410 	return (0);
411 }
412 
413 int
414 kdb_alt_break(int key, int *state)
415 {
416 
417 	return (kdb_alt_break_internal(key, state, 0));
418 }
419 
420 /*
421  * This variation on kdb_alt_break() is used only by dcons, which has its own
422  * configuration flag to force GDB use regardless of the global KDB
423  * configuration.
424  */
425 int
426 kdb_alt_break_gdb(int key, int *state)
427 {
428 
429 	return (kdb_alt_break_internal(key, state, 1));
430 }
431 
432 /*
433  * Print a backtrace of the calling thread. The backtrace is generated by
434  * the selected debugger, provided it supports backtraces. If no debugger
435  * is selected or the current debugger does not support backtraces, this
436  * function silently returns.
437  */
438 void
439 kdb_backtrace(void)
440 {
441 
442 	if (kdb_dbbe != NULL && kdb_dbbe->dbbe_trace != NULL) {
443 		printf("KDB: stack backtrace:\n");
444 		kdb_dbbe->dbbe_trace();
445 	}
446 #ifdef STACK
447 	else {
448 		struct stack st;
449 
450 		printf("KDB: stack backtrace:\n");
451 		stack_save(&st);
452 		stack_print_ddb(&st);
453 	}
454 #endif
455 }
456 
457 /*
458  * Similar to kdb_backtrace() except that it prints a backtrace of an
459  * arbitrary thread rather than the calling thread.
460  */
461 void
462 kdb_backtrace_thread(struct thread *td)
463 {
464 
465 	if (kdb_dbbe != NULL && kdb_dbbe->dbbe_trace_thread != NULL) {
466 		printf("KDB: stack backtrace of thread %d:\n", td->td_tid);
467 		kdb_dbbe->dbbe_trace_thread(td);
468 	}
469 #ifdef STACK
470 	else {
471 		struct stack st;
472 
473 		printf("KDB: stack backtrace of thread %d:\n", td->td_tid);
474 		if (stack_save_td(&st, td) == 0)
475 			stack_print_ddb(&st);
476 	}
477 #endif
478 }
479 
480 /*
481  * Set/change the current backend.
482  */
483 int
484 kdb_dbbe_select(const char *name)
485 {
486 	struct kdb_dbbe *be, **iter;
487 
488 	SET_FOREACH(iter, kdb_dbbe_set) {
489 		be = *iter;
490 		if (be->dbbe_active == 0 && strcmp(be->dbbe_name, name) == 0) {
491 			kdb_dbbe = be;
492 			return (0);
493 		}
494 	}
495 	return (EINVAL);
496 }
497 
498 static bool
499 kdb_backend_permitted(struct kdb_dbbe *be, struct ucred *cred)
500 {
501 	int error;
502 
503 	error = securelevel_gt(cred, kdb_enter_securelevel);
504 #ifdef MAC
505 	/*
506 	 * Give MAC a chance to weigh in on the policy: if the securelevel is
507 	 * not raised, then MAC may veto the backend, otherwise MAC may
508 	 * explicitly grant access.
509 	 */
510 	if (error == 0) {
511 		error = mac_kdb_check_backend(be);
512 		if (error != 0) {
513 			printf("MAC prevented execution of KDB backend: %s\n",
514 			    be->dbbe_name);
515 			return (false);
516 		}
517 	} else if (mac_kdb_grant_backend(be) == 0) {
518 		error = 0;
519 	}
520 #endif
521 	if (error != 0)
522 		printf("refusing to enter KDB with elevated securelevel\n");
523 	return (error == 0);
524 }
525 
526 /*
527  * Enter the currently selected debugger. If a message has been provided,
528  * it is printed first. If the debugger does not support the enter method,
529  * it is entered by using breakpoint(), which enters the debugger through
530  * kdb_trap().  The 'why' argument will contain a more mechanically usable
531  * string than 'msg', and is relied upon by DDB scripting to identify the
532  * reason for entering the debugger so that the right script can be run.
533  */
534 void
535 kdb_enter(const char *why, const char *msg)
536 {
537 
538 	if (kdb_dbbe != NULL && kdb_active == 0) {
539 		kdb_why = why;
540 		if (msg != NULL)
541 			printf("KDB: enter: %s\n", msg);
542 		breakpoint();
543 		kdb_why = KDB_WHY_UNSET;
544 	}
545 }
546 
547 /*
548  * Initialize the kernel debugger interface.
549  */
550 void
551 kdb_init(void)
552 {
553 	struct kdb_dbbe *be, **iter;
554 	int cur_pri, pri;
555 
556 	kdb_active = 0;
557 	kdb_dbbe = NULL;
558 	cur_pri = -1;
559 	SET_FOREACH(iter, kdb_dbbe_set) {
560 		be = *iter;
561 		pri = (be->dbbe_init != NULL) ? be->dbbe_init() : -1;
562 		be->dbbe_active = (pri >= 0) ? 0 : -1;
563 		if (pri > cur_pri) {
564 			cur_pri = pri;
565 			kdb_dbbe = be;
566 		}
567 	}
568 	if (kdb_dbbe != NULL) {
569 		printf("KDB: debugger backends:");
570 		SET_FOREACH(iter, kdb_dbbe_set) {
571 			be = *iter;
572 			if (be->dbbe_active == 0)
573 				printf(" %s", be->dbbe_name);
574 		}
575 		printf("\n");
576 		printf("KDB: current backend: %s\n",
577 		    kdb_dbbe->dbbe_name);
578 	}
579 }
580 
581 /*
582  * Handle contexts.
583  */
584 void *
585 kdb_jmpbuf(jmp_buf new)
586 {
587 	void *old;
588 
589 	old = kdb_jmpbufp;
590 	kdb_jmpbufp = new;
591 	return (old);
592 }
593 
594 void
595 kdb_reenter(void)
596 {
597 
598 	if (!kdb_active || kdb_jmpbufp == NULL)
599 		return;
600 
601 	printf("KDB: reentering\n");
602 	kdb_backtrace();
603 	longjmp(kdb_jmpbufp, 1);
604 	/* NOTREACHED */
605 }
606 
607 void
608 kdb_reenter_silent(void)
609 {
610 
611 	if (!kdb_active || kdb_jmpbufp == NULL)
612 		return;
613 
614 	longjmp(kdb_jmpbufp, 1);
615 	/* NOTREACHED */
616 }
617 
618 /*
619  * Thread-related support functions.
620  */
621 struct pcb *
622 kdb_thr_ctx(struct thread *thr)
623 {
624 #if defined(SMP) && defined(KDB_STOPPEDPCB)
625 	struct pcpu *pc;
626 #endif
627 
628 	if (thr == curthread)
629 		return (&kdb_pcb);
630 
631 #if defined(SMP) && defined(KDB_STOPPEDPCB)
632 	STAILQ_FOREACH(pc, &cpuhead, pc_allcpu)  {
633 		if (pc->pc_curthread == thr &&
634 		    CPU_ISSET(pc->pc_cpuid, &stopped_cpus))
635 			return (KDB_STOPPEDPCB(pc));
636 	}
637 #endif
638 	return (thr->td_pcb);
639 }
640 
641 struct thread *
642 kdb_thr_first(void)
643 {
644 	struct proc *p;
645 	struct thread *thr;
646 	u_int i;
647 
648 	/* This function may be called early. */
649 	if (pidhashtbl == NULL)
650 		return (&thread0);
651 
652 	for (i = 0; i <= pidhash; i++) {
653 		LIST_FOREACH(p, &pidhashtbl[i], p_hash) {
654 			thr = FIRST_THREAD_IN_PROC(p);
655 			if (thr != NULL)
656 				return (thr);
657 		}
658 	}
659 	return (NULL);
660 }
661 
662 struct thread *
663 kdb_thr_from_pid(pid_t pid)
664 {
665 	struct proc *p;
666 
667 	LIST_FOREACH(p, PIDHASH(pid), p_hash) {
668 		if (p->p_pid == pid)
669 			return (FIRST_THREAD_IN_PROC(p));
670 	}
671 	return (NULL);
672 }
673 
674 struct thread *
675 kdb_thr_lookup(lwpid_t tid)
676 {
677 	struct thread *thr;
678 
679 	thr = kdb_thr_first();
680 	while (thr != NULL && thr->td_tid != tid)
681 		thr = kdb_thr_next(thr);
682 	return (thr);
683 }
684 
685 struct thread *
686 kdb_thr_next(struct thread *thr)
687 {
688 	struct proc *p;
689 	u_int hash;
690 
691 	p = thr->td_proc;
692 	thr = TAILQ_NEXT(thr, td_plist);
693 	if (thr != NULL)
694 		return (thr);
695 	if (pidhashtbl == NULL)
696 		return (NULL);
697 	hash = p->p_pid & pidhash;
698 	for (;;) {
699 		p = LIST_NEXT(p, p_hash);
700 		while (p == NULL) {
701 			if (++hash > pidhash)
702 				return (NULL);
703 			p = LIST_FIRST(&pidhashtbl[hash]);
704 		}
705 		thr = FIRST_THREAD_IN_PROC(p);
706 		if (thr != NULL)
707 			return (thr);
708 	}
709 }
710 
711 int
712 kdb_thr_select(struct thread *thr)
713 {
714 	if (thr == NULL)
715 		return (EINVAL);
716 	kdb_thread = thr;
717 	kdb_thrctx = kdb_thr_ctx(thr);
718 	return (0);
719 }
720 
721 /*
722  * Enter the debugger due to a trap.
723  */
724 int
725 kdb_trap(int type, int code, struct trapframe *tf)
726 {
727 #ifdef SMP
728 	cpuset_t other_cpus;
729 #endif
730 	struct kdb_dbbe *be;
731 	register_t intr;
732 	int handled;
733 	int did_stop_cpus;
734 
735 	be = kdb_dbbe;
736 	if (be == NULL || be->dbbe_trap == NULL)
737 		return (0);
738 
739 	/* We reenter the debugger through kdb_reenter(). */
740 	if (kdb_active)
741 		return (0);
742 
743 	intr = intr_disable();
744 
745 	if (!SCHEDULER_STOPPED()) {
746 #ifdef SMP
747 		other_cpus = all_cpus;
748 		CPU_ANDNOT(&other_cpus, &other_cpus, &stopped_cpus);
749 		CPU_CLR(PCPU_GET(cpuid), &other_cpus);
750 		stop_cpus_hard(other_cpus);
751 #endif
752 		curthread->td_stopsched = 1;
753 		did_stop_cpus = 1;
754 	} else
755 		did_stop_cpus = 0;
756 
757 	kdb_active++;
758 
759 	kdb_frame = tf;
760 
761 	/* Let MD code do its thing first... */
762 	kdb_cpu_trap(type, code);
763 
764 	makectx(tf, &kdb_pcb);
765 	kdb_thr_select(curthread);
766 
767 	cngrab();
768 
769 	for (;;) {
770 		if (!kdb_backend_permitted(be, curthread->td_ucred)) {
771 			/* Unhandled breakpoint traps are fatal. */
772 			handled = 1;
773 			break;
774 		}
775 		handled = be->dbbe_trap(type, code);
776 		if (be == kdb_dbbe)
777 			break;
778 		be = kdb_dbbe;
779 		if (be == NULL || be->dbbe_trap == NULL)
780 			break;
781 		printf("Switching to %s back-end\n", be->dbbe_name);
782 	}
783 
784 	cnungrab();
785 
786 	kdb_active--;
787 
788 	if (did_stop_cpus) {
789 		curthread->td_stopsched = 0;
790 #ifdef SMP
791 		CPU_AND(&other_cpus, &other_cpus, &stopped_cpus);
792 		restart_cpus(other_cpus);
793 #endif
794 	}
795 
796 	intr_restore(intr);
797 
798 	return (handled);
799 }
800