1.\" $NetBSD: ddb.4,v 1.57 2002/02/15 12:20:33 simonb Exp $ 2.\" 3.\" Copyright (c) 1997 - 2001 The NetBSD Foundation, Inc. 4.\" All rights reserved. 5.\" 6.\" This code is derived from software contributed to The NetBSD Foundation 7.\" by Luke Mewburn 8.\" 9.\" Redistribution and use in source and binary forms, with or without 10.\" modification, are permitted provided that the following conditions 11.\" are met: 12.\" 1. Redistributions of source code must retain the above copyright 13.\" notice, this list of conditions and the following disclaimer. 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 3. All advertising materials mentioning features or use of this software 18.\" must display the following acknowledgement: 19.\" This product includes software developed by the NetBSD 20.\" Foundation, Inc. and its contributors. 21.\" 4. Neither the name of The NetBSD Foundation nor the names of its 22.\" contributors may be used to endorse or promote products derived 23.\" from this software without specific prior written permission. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 26.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 27.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 28.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 29.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 30.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 31.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 32.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 33.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 34.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 35.\" POSSIBILITY OF SUCH DAMAGE. 36.\" 37.\" --- 38.\" This manual page was derived from a -man.old document which bore 39.\" the following copyright message: 40.\" --- 41.\" 42.\" Mach Operating System 43.\" Copyright (c) 1991,1990 Carnegie Mellon University 44.\" All Rights Reserved. 45.\" 46.\" Permission to use, copy, modify and distribute this software and its 47.\" documentation is hereby granted, provided that both the copyright 48.\" notice and this permission notice appear in all copies of the 49.\" software, derivative works or modified versions, and any portions 50.\" thereof, and that both notices appear in supporting documentation. 51.\" 52.\" CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS" 53.\" CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR 54.\" ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE. 55.\" 56.\" Carnegie Mellon requests users of this software to return to 57.\" 58.\" Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU 59.\" School of Computer Science 60.\" Carnegie Mellon University 61.\" Pittsburgh PA 15213-3890 62.\" 63.\" any improvements or extensions that they make and grant Carnegie Mellon 64.\" the rights to redistribute these changes. 65.\" 66.Dd February 11, 2001 67.Dt DDB 4 68.Os 69.Sh NAME 70.Nm ddb 71.Nd in-kernel debugger 72.Sh SYNOPSIS 73.Cd options DDB 74.Pp 75To enable history editing: 76.Cd options DDB_HISTORY_SIZE=integer 77.Pp 78To disable entering 79.Nm 80upon kernel panic: 81.Cd options DDB_ONPANIC=0 82.Sh DESCRIPTION 83.Nm 84is the in-kernel debugger. 85It may be entered at any time via a special key sequence, and 86optionally may be invoked when the kernel panics. 87.Sh ENTERING THE DEBUGGER 88Unless 89.Dv DDB_ONPANIC 90is set to 0, 91.Nm 92will be activated whenever the kernel would otherwise panic. 93.Pp 94.Nm 95may also be activated from the console. 96In general, sending a break on a serial console will activate 97.Nm "" . 98There are also key sequences for each port that will activate 99.Nm 100from the keyboard: 101.Bl -tag -offset indent -width "mvme68k" -compact 102.It alpha 103\*[Lt]Ctrl\*[Gt]-\*[Lt]Alt\*[Gt]-\*[Lt]Esc\*[Gt] on PC style keyboards. 104.It amiga 105\*[Lt]LAlt\*[Gt]-\*[Lt]LAmiga\*[Gt]-\*[Lt]F10\*[Gt] 106.It atari 107\*[Lt]Alt\*[Gt]-\*[Lt]LeftShift\*[Gt]-\*[Lt]F9\*[Gt] 108.It hp300 109\*[Lt]Shift\*[Gt]-\*[Lt]Reset\*[Gt] 110.It hpcmips 111\*[Lt]Ctrl\*[Gt]-\*[Lt]Alt\*[Gt]-\*[Lt]Esc\*[Gt] 112.It i386 113\*[Lt]Ctrl\*[Gt]-\*[Lt]Alt\*[Gt]-\*[Lt]Esc\*[Gt] 114.br 115\*[Lt]Break\*[Gt] on serial console. 116.It mac68k 117\*[Lt]Command\*[Gt]-\*[Lt]Power\*[Gt], or the Interrupt switch. 118.It mvme68k 119Abort switch on CPU card. 120.It pmax 121\*[Lt]Do\*[Gt] on 122.Tn LK-201 123rcons console. 124.br 125\*[Lt]Break\*[Gt] on serial console. 126.It sparc 127\*[Lt]L1\*[Gt]-A, or \*[Lt]Stop\*[Gt]-A on a 128.Tn Sun 129keyboard. 130.br 131\*[Lt]Break\*[Gt] on serial console. 132.It sun3 133\*[Lt]L1\*[Gt]-A, or \*[Lt]Stop\*[Gt]-A on a 134.Tn Sun 135keyboard. 136.br 137\*[Lt]Break\*[Gt] on serial console. 138.It sun3x 139\*[Lt]L1\*[Gt]-A, or \*[Lt]Stop\*[Gt]-A on a 140.Tn Sun 141keyboard. 142.br 143\*[Lt]Break\*[Gt] on serial console. 144.It x68k 145Interrupt switch on the body. 146.El 147.Pp 148In addition, 149.Nm 150may be explicitly activated by the debugging code in the kernel 151if 152.Cm DDB 153is configured. 154.Sh COMMAND SYNTAX 155The general command syntax is: 156.Bd -ragged -offset indent 157.Ic command Ns Op Cm / Ns Ar modifier 158.Ar address 159.Op Cm , Ns Ar count 160.Ed 161.Pp 162The current memory location being edited is referred to as 163.Ar dot , 164and the next location is 165.Ar next . 166They are displayed as hexadecimal numbers. 167.Pp 168Commands that examine and/or modify memory update 169.Ar dot 170to the address of the last line examined or the last location 171modified, and set 172.Ar next 173to the next location to be examined or modified. 174Other commands don't change 175.Ar dot , 176and set 177.Ar next 178to be the same as 179.Ar dot . 180.Pp 181A blank line repeats the previous command from the address 182.Ar next 183with the previous 184.Cm count 185and no modifiers. 186Specifying 187.Cm address 188sets 189.Em dot 190to the address. 191If 192.Cm address 193is omitted, 194.Em dot 195is used. 196A missing 197.Cm count 198is taken to be 1 for printing commands, and infinity for stack traces. 199.Pp 200The syntax: 201.Bd -ragged -offset indent 202.Ic Cm , Ns Ar count 203.Ed 204.Pp 205repeats the previous command, just as a blank line does, but with 206the specified 207.Cm count . 208.Pp 209.Nm 210has a 211.Xr more 1 -like 212functionality; if a number of lines in a command's output exceeds the number 213defined in the 214.Va lines 215variable, then 216.Nm 217displays 218.Dq "--db more--" 219and waits for a response, which may be one of: 220.Bl -tag -offset indent -width "\*[Lt]return\*[Gt]" 221.It \*[Lt]return\*[Gt] 222one more line. 223.It \*[Lt]space\*[Gt] 224one more page. 225.It Ic q 226abort the current command, and return to the command input mode. 227.El 228.Pp 229If 230.Nm 231history editing is enabled (by defining the 232.D1 Cd options DDB_HISTORY_SIZE=num 233kernel option), then a history of the last 234.Cm num 235commands is kept. 236The history can be manipulated with the following key sequences: 237.Bl -tag -offset indent -width "\*[Lt]Ctrl\*[Gt]-P" 238.It \*[Lt]Ctrl\*[Gt]-P 239retrieve previous command in history (if any). 240.It \*[Lt]Ctrl\*[Gt]-N 241retrieve next command in history (if any). 242.El 243.Sh COMMANDS 244.Nm 245supports the following commands: 246.Bl -tag -width 5n 247.It Xo 248.Sm off 249.Ic ! 250.Ar address 251.Oo 252.Cm ( Ar expression 253.Op Ar ,... 254.Cm ) 255.Oc 256.Sm on 257.Xc 258A synonym for 259.Ic call . 260.It Xo 261.Ic break Ns Op Cm /u 262.Ar address Ns Op Cm , Ns Ar count 263.Xc 264Set a breakpoint at 265.Ar address . 266If 267.Ar count 268is supplied, continues 269.Pq Ar count Ns -1 270times before stopping at the breakpoint. 271If the breakpoint is set, a breakpoint number is printed with 272.Sq \&# . 273This number can be used to 274.Ic delete 275the breakpoint, or to add 276conditions to it. 277.Pp 278If 279.Cm /u 280is specified, 281set a breakpoint at a user-space address. 282Without 283.Cm /u , 284.Ar address 285is considered to be in the kernel-space, and an address in the wrong 286space will be rejected, and an error message will be emitted. 287This modifier may only be used if it is supported by machine dependent 288routines. 289.Pp 290Warning: if a user text is shadowed by a normal user-space debugger, 291user-space breakpoints may not work correctly. 292Setting a breakpoint at the low-level code paths may also cause 293strange behavior. 294.It Xo 295.Ic call 296.Sm off 297.Ar address 298.Oo 299.Cm ( Ar expression 300.Op Ar ,... 301.Cm ) 302.Oc 303.Sm on 304.Xc 305Call the function specified by 306.Ar address 307with the argument(s) listed in parentheses. 308Parentheses may be omitted if the function takes no arguments. 309The number of arguments is currently limited to 10. 310.It Ic continue Ns Op Cm /c 311Continue execution until a breakpoint or watchpoint. 312If 313.Cm /c 314is specified, count instructions while executing. 315Some machines (e.g., pmax) also count loads and stores. 316.Pp 317Warning: when counting, the debugger is really silently 318single-stepping. 319This means that single-stepping on low-level may cause strange 320behavior. 321.It Xo 322.Ic delete 323.Ar "address" | 324.Cm # Ns Ar number 325.Xc 326Delete a breakpoint. 327The target breakpoint may be specified by 328.Ar address , 329as per 330.Ic break , 331or by the breakpoint number returned by 332.Ic break 333if it's prefixed with 334.Sq Cm \&# . 335.It Xo 336.Ic dwatch 337.Ar address 338.Xc 339Delete the watchpoint at 340.Ar address 341that was previously set with 342.Ic watch 343command. 344.It Xo 345.Ic examine Ns Op Cm / Ns Ar modifier 346.Ar address Ns Op Cm , Ns Ar count 347.Xc 348Display the address locations according to the format in 349.Ar modifier . 350Multiple modifier formats display multiple locations. 351If 352.Ar modifier 353isn't specified, the modifier from the last use of 354.Ic examine 355is used. 356.Pp 357The valid format characters for 358.Ar modifier 359are: 360.Bl -tag -offset indent -width 2n -compact 361.It Cm b 362examine bytes (8 bits). 363.It Cm h 364examine half-words (16 bits). 365.It Cm l 366examine words (legacy 367.Dq long , 36832 bits). 369.It Cm L 370examine long words (implementation dependent) 371.It Cm a 372print the location being examined. 373.It Cm A 374print the location with a line number if possible. 375.It Cm x 376display in unsigned hex. 377.It Cm z 378display in signed hex. 379.It Cm o 380display in unsigned octal. 381.It Cm d 382display in signed decimal. 383.It Cm u 384display in unsigned decimal. 385.It Cm r 386display in current radix, signed. 387.It Cm c 388display low 8 bits as a character. 389Non-printing characters as displayed as an octal escape code 390(e.g., 391.Sq \e000 ) . 392.It Cm s 393display the NUL terminated string at the location. 394Non-printing characters are displayed as octal escapes. 395.It Cm m 396display in unsigned hex with a character dump at the end of each line. 397The location is displayed as hex at the beginning of each line. 398.It Cm i 399display as a machine instruction. 400.It Cm I 401display as a machine instruction, with possible alternative formats 402depending upon the machine: 403.Bl -tag -offset indent -width "sparc" -compact 404.It alpha 405print register operands 406.It m68k 407use Motorola syntax 408.It pc532 409print instruction bytes in hex 410.It vax 411don't assume that each external label is a procedure entry mask 412.El 413.El 414.It Xo 415.Ic kill 416.Ar pid Ns Op Cm , Ns Ar signal_number 417.Xc 418Send a signal to the process specified by the 419.Ar pid . 420Note that 421.Ar pid 422is interpreted using the current radix (see 423.Cm trace/t 424command for details). 425If 426.Ar signal_number 427isn't specified, the SIGTERM signal is sent. 428.It Ic match Ns Op Cm /p 429A synonym for 430.Ic next . 431.It Ic next Ns Op Cm /p 432Stop at the matching return instruction. 433If 434.Cm /p 435is specified, print the call nesting depth and the 436cumulative instruction count at each call or return. 437Otherwise, only print when the matching return is hit. 438.It Xo 439.Ic print Ns Op Cm /axzodurc 440.Ar address Op Ar address ... 441.Xc 442Print addresses 443.Ar address 444according to the modifier character, as per 445.Ic examine . 446Valid modifiers are: 447.Cm /a , 448.Cm /x , 449.Cm /z , 450.Cm /o , 451.Cm /d , 452.Cm /u , 453.Cm /r , 454and 455.Cm /c 456(as per 457.Ic examine ) . 458If no modifier is specified, the most recent one specified is used. 459.Ar address 460may be a string, and is printed 461.Dq as-is . 462For example: 463.Bd -literal -offset indent 464print/x "eax = " $eax "\enecx = " $ecx "\en" 465.Ed 466.Pp 467will produce: 468.Bd -literal -offset indent 469eax = xxxxxx 470ecx = yyyyyy 471.Ed 472.It Xo 473.Sm off 474.Ic ps 475.Op Cm /a 476.Op Cm /n 477.Op Cm /w 478.Sm on 479.Xc 480A synonym for 481.Ic "show all procs" . 482.It Ic reboot Op Ar flags 483Reboot, using the optionally supplied boot 484.Ar flags . 485.Pp 486Note: Limitations of the command line interface preclude 487specification of a boot string. 488.It Xo 489.Ic search Ns Op Cm /bhl 490.Ar address 491.Ar value 492.Op Ar mask 493.Op Cm , Ns Ar count 494.Xc 495Search memory from 496.Ar address 497for 498.Ar value . 499The unit size is specified with a modifier character, as per 500.Ic examine . 501Valid modifiers are: 502.Cm /b , 503.Cm /h , 504and 505.Cm /l . 506If no modifier is specified, 507.Cm /l 508is used. 509.Pp 510This command might fail in interesting ways if it doesn't find 511.Ar value . 512This is because 513.Nm 514doesn't always recover from touching bad memory. 515The optional 516.Ar count 517limits the search. 518.It Xo 519.Ic set 520.Cm $ Ns Ar variable 521.Op Cm = 522.Ar expression 523.Xc 524Set the named variable or register to the value of 525.Ar expression . 526Valid variable names are described in 527.Sx VARIABLES . 528.It Xo 529.Sm off 530.Ic "show\ all\ procs" 531.Op Cm /a 532.Op Cm /n 533.Op Cm /w 534.Sm on 535.Xc 536Display all process information. 537Valid modifiers: 538.Bl -tag -width 3n 539.It Cm /n 540show process information in a 541.Xr ps 1 542style format (this is the default). 543Information printed includes: process ID, parent process ID, 544process group, UID, process status, process flags, process 545command name, and process wait channel message. 546.It Cm /a 547show the kernel virtual addresses of each process' 548proc structure, u-area, and vmspace structure. 549The vmspace address is also the address of the process' 550vm_map structure, and can be used in the 551.Ic "show map" 552command. 553.It Cm /w 554show each process' PID, command, system call emulation, wait channel 555address, and wait channel message. 556.El 557.It Ic "show breaks" 558Display all breakpoints. 559.It Xo 560.Ic "show buf" Ns Op Cm /f 561.Ar address 562.Xc 563Print the struct buf at 564.Ar address . 565The 566.Cm /f 567does nothing at this time. 568.It Xo 569.Ic "show event" Ns Op Cm /f 570.Xc 571Print all the non-zero 572.Xr evcnt 9 573event counters. 574If 575.Cm /f 576is specified, all event counters with a count of zero are printed as well. 577.It Xo 578.Ic "show map" Ns Op Cm /f 579.Ar address 580.Xc 581Print the vm_map at 582.Ar address . 583If 584.Cm /f 585is specified, the complete map is printed. 586.It Ic "show ncache" Ar address 587Dump the namecache list associated with vnode at 588.Ar address . 589.It Xo 590.Ic "show object" Ns Op Cm /f 591.Ar address 592.Xc 593Print the vm_object at 594.Ar address . 595If 596.Cm /f 597is specified, the complete object is printed. 598.It Xo 599.Ic "show page" Ns Op Cm /f 600.Ar address 601.Xc 602Print the vm_page at 603.Ar address . 604If 605.Cm /f 606is specified, the complete page is printed. 607.It Xo 608.Ic "show pool" Ns Op Cm /clp 609.Ar address 610.Xc 611Print the pool at 612.Ar address . 613Valid modifiers: 614.Bl -tag -width 4n -compact 615.It Cm /c 616Print the cachelist and its statistics for this pool. 617.It Cm /l 618Print the log entries for this pool. 619.It Cm /p 620Print the pagelist for this pool. 621.El 622.It Ic "show registers" Ns Op Cm /u 623Display the register set. 624If 625.Cm /u 626is specified, display user registers instead of kernel registers 627or the currently save one. 628.Pp 629Warning: support for 630.Cm /u 631is machine dependent. 632If not supported, incorrect information will be displayed. 633.It Ic "show uvmexp" 634Print a selection of UVM counters and statistics. 635.It Xo 636.Ic "show vnode" Ns Op Cm /f 637.Ar address 638.Xc 639Print the vnode at 640.Ar address . 641If 642.Cm /f 643is specified, the complete vnode is printed. 644.It Ic "show watches" 645Display all watchpoints. 646.It Xo 647.Ic sifting Ns Op Cm /F 648.Ar string 649.Xc 650Search the symbol tables for all symbols of which 651.Ar string 652is a substring, and display them. If 653.Cm /F 654is specified, a character is displayed immediately after each symbol 655name indicating the type of symbol. 656.Pp 657For 658.Ns Xr a.out 5 -format 659symbol tables, 660absolute symbols display 661.Sy @ , 662text segment symbols display 663.Sy * , 664data segment symbols display 665.Sy + , 666.Tn BSS 667segment symbols display 668.Sy - , 669and filename symbols display 670.Sy / . 671For 672.Tn ELF Ns -format 673symbol tables, 674object symbols display 675.Sy + , 676function symbols display 677.Sy * , 678section symbols display 679.Sy \*[Am] , 680and file symbols display 681.Sy / . 682.Pp 683To sift for a string beginning with a number, escape the first 684character with a backslash as: 685.Bd -literal -offset indent 686sifting \\386 687.Ed 688.It Xo 689.Ic step Ns Op Cm /p 690.Op Cm , Ns Ar count 691.Xc 692Single-step 693.Ar count 694times. 695If 696.Cm /p 697is specified, print each instruction at each step. 698Otherwise, only print the last instruction. 699.Pp 700Warning: depending on the machine type, it may not be possible 701to single-step through some low-level code paths or user-space 702code. 703On machines with software-emulated single-stepping (e.g., pmax), 704stepping through code executed by interrupt handlers will probably 705do the wrong thing. 706.It Ic sync 707Force a crash dump, and then reboot. 708.It Xo 709.Ic trace Ns Op Cm /u 710.Sm off 711.Op Ar frame-address 712.Op Cm , Ar count 713.Sm on 714.Xc 715Stack trace from 716.Ar frame-address . 717If 718.Cm /u 719is specified, trace user-space, otherwise trace kernel-space. 720.Ar count 721is the number of frames to be traced. 722If 723.Ar count 724is omitted, all frames are printed. 725.Pp 726Warning: user-space stack trace is valid only if the machine dependent 727code supports it. 728.It Xo 729.Ic trace/t 730.Sm off 731.Op Ar pid 732.Op Cm , Ar count 733.Sm on 734.Xc 735Stack trace by 736.Dq thread 737(process, on 738.Nx ) 739rather than by stack frame address. 740Note that 741.Ar pid 742is interpreted using the current radix, whilst 743.Ic ps 744displays pids in decimal; prefix 745.Ar pid 746with 747.Sq 0t 748to force it to be interpreted as decimal (see 749.Sx VARIABLES 750section for radix) 751.Pp 752Warning: trace by pid is valid only if the machine dependent code 753supports it. 754.It Ic until Ns Op Cm /p 755Stop at the next call or return instruction. 756If 757.Cm /p 758is specified, print the call nesting depth and the 759cumulative instruction count at each call or return. 760Otherwise, only print when the matching return is hit. 761.It Xo 762.Ic watch 763.Sm off 764.Ar address 765.Op Cm , Ar size 766.Sm on 767.Xc 768Set a watchpoint for a region. 769Execution stops when an attempt to modify the region occurs. 770.Ar size 771defaults to 4. 772.Pp 773If you specify a wrong space address, the request is 774rejected with an error message. 775.Pp 776Warning: attempts to watch wired kernel memory may cause 777an unrecoverable error in some systems such as i386. 778Watchpoints on user addresses work the best. 779.It Xo 780.Ic write Ns Op Cm /bhl 781.Ar address 782.Ar expression Op Ar expression ... 783.Xc 784Write the 785.Ar expression Ns s 786at succeeding locations. 787The unit size is specified with a modifier character, as per 788.Ic examine . 789Valid modifiers are: 790.Cm /b , 791.Cm /h , 792and 793.Cm /l . 794If no modifier is specified, 795.Cm /l 796is used. 797.Pp 798Warning: since there is no delimiter between 799.Ar expression Ns s , 800strange things may occur. 801It's best to enclose each 802.Ar expression 803in parentheses. 804.It Xo 805.Ic x Ns Op Cm / Ns Ar modifier 806.Ar address Ns Op Cm , Ns Ar count 807.Xc 808A synonym for 809.Ic examine . 810.\" XXX - these commands aren't implemented; jhawk 19 May 2000 811.\" .It Ic xf 812.\" Examine forward. 813.\" .Ic xf 814.\" re-executes the most recent 815.\" .Ic execute 816.\" command with the same parameters except that 817.\" .Ar address 818.\" is set to 819.\" .Ar next . 820.\" .It Ic xb 821.\" Examine backward. 822.\" .Ic xb 823.\" re-executes the most recent 824.\" .Ic execute 825.\" command with the same parameters, except that 826.\" .Ar address 827.\" is set to the last start address minus its size. 828.El 829.Sh MACHINE-SPECIFIC COMMANDS 830The "glue" code that hooks 831.Nm 832into the 833.Nx 834kernel for any given port can also add machine specific commands 835to the 836.Nm 837command parser. 838All of these commands are preceded by the command word 839.Em machine 840to indicate that they are part of the machine-specific command 841set (e.g. 842.Ic "machine reboot" ) . 843Some of these commands are: 844.Ss ALPHA 845.Bl -tag -width "intrchain" -compact 846.It Ic halt 847Call the PROM monitor to halt the CPU. 848.It Ic reboot 849Call the PROM monitor to reboot the CPU. 850.El 851.Ss ARM32 852.Bl -tag -width "intrchain" -compact 853.It Ic vmstat 854Equivalent to 855.Xr vmstat 1 856output with "-s" option (statistics). 857.It Ic vnode 858Print out a description of a vnode. 859.It Ic intrchain 860Print the list of IRQ handlers. 861.It Ic panic 862Print the current "panic" string. 863.It Ic frame 864Given a trap frame address, print out the trap frame. 865.El 866.Ss MIPS 867.Bl -tag -width "intrchain" -compact 868.It Ic kvtop 869Print the physical address for a given kernel virtual address. 870.It Ic tlb 871Print out the Translation Lookaside Buffer (TLB). 872Only works in 873.Nx 874kernels compiled with 875.Dv DEBUG 876option. 877.El 878.Ss SPARC 879.Bl -tag -width "intrchain" -compact 880.It Ic prom 881Exit to the Sun PROM monitor. 882.El 883.Ss SPARC64 884.Bl -tag -width "intrchain" -compact 885.It Ic buf 886Print buffer information. 887.It Ic ctx 888Print process context information. 889.It Ic dtlb 890Print data translation look-aside buffer context information. 891.It Ic dtsb 892Display data translation storage buffer information. 893.It Ic kmap 894Display information about the listed mapping in the kernel pmap. Use the 895.Dq f 896modifier to get a full listing. 897.It Ic pcb 898Display information about the 899.Dq struct pcb 900listed. 901.It Ic pctx 902Attempt to change process context. 903.It Ic page 904Display the pointer to the 905.Dq struct vm_page 906for this physical address. 907.It Ic phys 908Display physical memory. 909.It Ic pmap 910Display the pmap. Use the 911.Dq f 912modifier to get a fuller listing. 913.It Ic proc 914Display some information about the process pointed to, or curproc. 915.It Ic prom 916Enter the OFW prom. 917.It Ic pv 918Display the 919.Dq struct pv_entry 920pointed to. 921.It Ic stack 922Dump the window stack. Use the 923.Dq u 924modifier to get userland information. 925.It Ic tf 926Display full trap frame state. This is most useful for inclusion with 927bug reports. 928.It Ic ts 929Display trap state. 930.It Ic traptrace 931Display or set trap trace information. Use the 932.Dq r 933and 934.Dq f 935modifiers to get reversed and full information, respectively. 936.It Ic uvmdump 937Dumps the UVM histories. 938.It Ic watch 939Set or clear a physical or virtual hardware watchpoint. Pass the address 940to be watched, or 941.Dq 0 942to clear the watchpoint. Append 943.Dq p 944to the watch point to use the physical watchpoint registers. 945.It Ic window 946Print register window information about given address. 947.El 948.Ss SUN3 and SUN3X 949.Bl -tag -width "intrchain" -compact 950.It Ic abort 951Drop into monitor via abort (allows continue). 952.It Ic halt 953Exit to Sun PROM monitor as in 954.Xr halt 8 . 955.It Ic reboot 956Reboot the machine as in 957.Xr reboot 8 . 958.It Ic pgmap 959Given an address, print the address, segment map, page map, and 960Page Table Entry (PTE). 961.El 962.Sh VARIABLES 963.Nm 964accesses registers and variables as 965.Cm $ Ns Ar name . 966Register names are as per the 967.Ic "show registers" 968command. 969Some variables are suffixed with numbers, and may have a modifier 970following a colon immediately after the variable name. 971For example, register variables may have a 972.Sq u 973modifier to indicate user register 974(e.g., 975.Li "$eax:u" ) . 976.Pp 977Built-in variables currently supported are: 978.Bl -tag -offset indent -width "maxwidth" -compact 979.It Va lines 980The number of lines. 981This is used by the 982.Ic more 983feature. 984.It Va maxoff 985Addresses are printed as 986.Li 'symbol'+offset 987unless 988.Li offset 989is greater than 990.Va maxoff . 991.It Va maxwidth 992The width of the displayed line. 993.It Va onpanic 994If non-zero (the default), 995.Nm 996will be invoked when the kernel panics. 997If the kernel configuration option 998.D1 Cd options DDB_ONPANIC=0 999is used, 1000.Va onpanic 1001will be initialized to off. 1002.It Va fromconsole 1003If non-zero (the default), 1004the kernel allows to enter 1005.Nm 1006from the console (by break signal or special key sequence). 1007If the kernel configuration option 1008.D1 Cd options DDB_FROMCONSOLE=0 1009is used, 1010.Va fromconsole 1011will be initialized to off. 1012.It Va radix 1013Input and output radix. 1014.It Va tabstops 1015Tab stop width. 1016.\" .It Va work Ns Sy xx 1017.\" Temporary work variable. 1018.\" .Sq Sy xx 1019.\" is between 0 and 31. 1020.El 1021.Pp 1022All built-in variables are accessible via 1023.Xr sysctl 3 . 1024.Sh EXPRESSIONS 1025Almost all expression operators in C are supported, except 1026.Sq \&~ , 1027.Sq \&^ , 1028and unary 1029.Sq \&\*[Am] . 1030Special rules in 1031.Nm 1032are: 1033.Bl -tag -offset indent -width "identifier" 1034.It Ar identifier 1035name of a symbol. 1036It is translated to the address (or value) of it. 1037.Sq \&. 1038and 1039.Sq \&: 1040can be used in the identifier. 1041If supported by an object format dependent routine, 1042.Sm off 1043.Xo 1044.Oo Ar filename : Oc 1045.Ar function 1046.Oo : Ar "line number" Oc , 1047.Xc 1048.Xo 1049.Oo Ar filename : Oc 1050.Ar variable , 1051.Xc 1052and 1053.Xo 1054.Ar filename 1055.Oo : Ar "line number" Oc , 1056.Xc 1057.Sm on 1058can be accepted as a symbol. 1059The symbol may be prefixed with 1060.Ar symbol_table_name : : 1061(e.g., 1062.Li emulator::mach_msg_trap ) 1063to specify other than kernel symbols. 1064.It Ar number 1065number. 1066Radix is determined by the first two characters: 1067.Sq 0x 1068- hex, 1069.Sq 0o 1070- octal, 1071.Sq 0t 1072- decimal, 1073otherwise follow current radix. 1074.It Cm . 1075.Ar dot 1076.It Cm + 1077.Ar next 1078.It Cm .. 1079address of the start of the last line examined. 1080Unlike 1081.Ar dot 1082or 1083.Ar next , 1084this is only changed by the 1085.Ic examine 1086or 1087.Ic write 1088commands. 1089.It Cm \&" 1090last address explicitly specified. 1091.It Cm $ Ns Ar name 1092register name or variable. 1093It is translated to the value of it. 1094It may be followed by a 1095.Sq \&: 1096and modifiers as described above. 1097.It Cm a 1098multiple of right-hand side. 1099.It Cm * Ns Ar expr 1100expression indirection. 1101It may be followed by a 1102.Sq \&: 1103and modifiers as described above. 1104.El 1105.Sh SEE ALSO 1106.Xr options 4 , 1107.Xr sysctl 8 1108.Sh HISTORY 1109The 1110.Nm 1111kernel debugger was written as part of the MACH project at 1112Carnegie-Mellon University. 1113