1.\" $NetBSD: ddb.4,v 1.63 2003/03/30 18:05:22 wiz Exp $ 2.\" 3.\" Copyright (c) 1997 - 2003 The NetBSD Foundation, Inc. 4.\" All rights reserved. 5.\" 6.\" This code is derived from software contributed to The NetBSD Foundation 7.\" by Luke Mewburn 8.\" 9.\" Redistribution and use in source and binary forms, with or without 10.\" modification, are permitted provided that the following conditions 11.\" are met: 12.\" 1. Redistributions of source code must retain the above copyright 13.\" notice, this list of conditions and the following disclaimer. 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 3. All advertising materials mentioning features or use of this software 18.\" must display the following acknowledgement: 19.\" This product includes software developed by the NetBSD 20.\" Foundation, Inc. and its contributors. 21.\" 4. Neither the name of The NetBSD Foundation nor the names of its 22.\" contributors may be used to endorse or promote products derived 23.\" from this software without specific prior written permission. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 26.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 27.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 28.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 29.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 30.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 31.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 32.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 33.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 34.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 35.\" POSSIBILITY OF SUCH DAMAGE. 36.\" 37.\" --- 38.\" This manual page was derived from a -man.old document which bore 39.\" the following copyright message: 40.\" --- 41.\" 42.\" Mach Operating System 43.\" Copyright (c) 1991,1990 Carnegie Mellon University 44.\" All Rights Reserved. 45.\" 46.\" Permission to use, copy, modify and distribute this software and its 47.\" documentation is hereby granted, provided that both the copyright 48.\" notice and this permission notice appear in all copies of the 49.\" software, derivative works or modified versions, and any portions 50.\" thereof, and that both notices appear in supporting documentation. 51.\" 52.\" CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS" 53.\" CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR 54.\" ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE. 55.\" 56.\" Carnegie Mellon requests users of this software to return to 57.\" 58.\" Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU 59.\" School of Computer Science 60.\" Carnegie Mellon University 61.\" Pittsburgh PA 15213-3890 62.\" 63.\" any improvements or extensions that they make and grant Carnegie Mellon 64.\" the rights to redistribute these changes. 65.\" 66.Dd March 4, 2003 67.Dt DDB 4 68.Os 69.Sh NAME 70.Nm ddb 71.Nd in-kernel debugger 72.Sh SYNOPSIS 73.Cd options DDB 74.Pp 75To enable history editing: 76.Cd options DDB_HISTORY_SIZE=integer 77.Pp 78To disable entering 79.Nm 80upon kernel panic: 81.Cd options DDB_ONPANIC=0 82.Sh DESCRIPTION 83.Nm 84is the in-kernel debugger. 85It may be entered at any time via a special key sequence, and 86optionally may be invoked when the kernel panics. 87.Sh ENTERING THE DEBUGGER 88Unless 89.Dv DDB_ONPANIC 90is set to 0, 91.Nm 92will be activated whenever the kernel would otherwise panic. 93.Pp 94.Nm 95may also be activated from the console. 96In general, sending a break on a serial console will activate 97.Nm . 98There are also key sequences for each port that will activate 99.Nm 100from the keyboard: 101.Bl -tag -offset indent -width "mvme68k" -compact 102.It alpha 103\*[Lt]Ctrl\*[Gt]-\*[Lt]Alt\*[Gt]-\*[Lt]Esc\*[Gt] on PC style keyboards. 104.It amiga 105\*[Lt]LAlt\*[Gt]-\*[Lt]LAmiga\*[Gt]-\*[Lt]F10\*[Gt] 106.It atari 107\*[Lt]Alt\*[Gt]-\*[Lt]LeftShift\*[Gt]-\*[Lt]F9\*[Gt] 108.It hp300 109\*[Lt]Shift\*[Gt]-\*[Lt]Reset\*[Gt] 110.It hpcmips 111\*[Lt]Ctrl\*[Gt]-\*[Lt]Alt\*[Gt]-\*[Lt]Esc\*[Gt] 112.It hpcsh 113\*[Lt]Ctrl\*[Gt]-\*[Lt]Alt\*[Gt]-\*[Lt]Esc\*[Gt] 114.It i386 115\*[Lt]Ctrl\*[Gt]-\*[Lt]Alt\*[Gt]-\*[Lt]Esc\*[Gt] 116.br 117\*[Lt]Break\*[Gt] on serial console. 118.It mac68k 119\*[Lt]Command\*[Gt]-\*[Lt]Power\*[Gt], or the Interrupt switch. 120.It macppc 121Some models: 122\*[Lt]Command\*[Gt]-\*[Lt]Option\*[Gt]-\*[Lt]Power\*[Gt] 123.It mvme68k 124Abort switch on CPU card. 125.It pmax 126\*[Lt]Do\*[Gt] on 127.Tn LK-201 128rcons console. 129.br 130\*[Lt]Break\*[Gt] on serial console. 131.It sparc 132\*[Lt]L1\*[Gt]-A, or \*[Lt]Stop\*[Gt]-A on a 133.Tn Sun 134keyboard. 135.br 136\*[Lt]Break\*[Gt] on serial console. 137.It sun3 138\*[Lt]L1\*[Gt]-A, or \*[Lt]Stop\*[Gt]-A on a 139.Tn Sun 140keyboard. 141.br 142\*[Lt]Break\*[Gt] on serial console. 143.It sun3x 144\*[Lt]L1\*[Gt]-A, or \*[Lt]Stop\*[Gt]-A on a 145.Tn Sun 146keyboard. 147.br 148\*[Lt]Break\*[Gt] on serial console. 149.It x68k 150Interrupt switch on the body. 151.El 152.Pp 153In addition, 154.Nm 155may be explicitly activated by the debugging code in the kernel 156if 157.Cm DDB 158is configured. 159.Sh COMMAND SYNTAX 160The general command syntax is: 161.Bd -ragged -offset indent 162.Ic command Ns Op Cm / Ns Ar modifier 163.Ar address 164.Op Cm , Ns Ar count 165.Ed 166.Pp 167The current memory location being edited is referred to as 168.Ar dot , 169and the next location is 170.Ar next . 171They are displayed as hexadecimal numbers. 172.Pp 173Commands that examine and/or modify memory update 174.Ar dot 175to the address of the last line examined or the last location 176modified, and set 177.Ar next 178to the next location to be examined or modified. 179Other commands don't change 180.Ar dot , 181and set 182.Ar next 183to be the same as 184.Ar dot . 185.Pp 186A blank line repeats the previous command from the address 187.Ar next 188with the previous 189.Cm count 190and no modifiers. 191Specifying 192.Cm address 193sets 194.Em dot 195to the address. 196If 197.Cm address 198is omitted, 199.Em dot 200is used. 201A missing 202.Cm count 203is taken to be 1 for printing commands, and infinity for stack traces. 204.Pp 205The syntax: 206.Bd -ragged -offset indent 207.Ic Cm , Ns Ar count 208.Ed 209.Pp 210repeats the previous command, just as a blank line does, but with 211the specified 212.Cm count . 213.Pp 214.Nm 215has a 216.Xr more 1 -like 217functionality; if a number of lines in a command's output exceeds the number 218defined in the 219.Va lines 220variable, then 221.Nm 222displays 223.Dq "--db more--" 224and waits for a response, which may be one of: 225.Bl -tag -offset indent -width "\*[Lt]return\*[Gt]" 226.It \*[Lt]return\*[Gt] 227one more line. 228.It \*[Lt]space\*[Gt] 229one more page. 230.It Ic q 231abort the current command, and return to the command input mode. 232.El 233.Pp 234If 235.Nm 236history editing is enabled (by defining the 237.D1 Cd options DDB_HISTORY_SIZE=num 238kernel option), then a history of the last 239.Cm num 240commands is kept. 241The history can be manipulated with the following key sequences: 242.Bl -tag -offset indent -width "\*[Lt]Ctrl\*[Gt]-P" 243.It \*[Lt]Ctrl\*[Gt]-P 244retrieve previous command in history (if any). 245.It \*[Lt]Ctrl\*[Gt]-N 246retrieve next command in history (if any). 247.El 248.Sh COMMANDS 249.Nm 250supports the following commands: 251.Bl -tag -width 5n 252.It Xo 253.Sm off 254.Ic ! 255.Ar address 256.Oo 257.Cm ( Ar expression 258.Op Ar ,... 259.Cm ) 260.Oc 261.Sm on 262.Xc 263A synonym for 264.Ic call . 265.It Xo 266.Ic break Ns Op Cm /u 267.Ar address Ns Op Cm , Ns Ar count 268.Xc 269Set a breakpoint at 270.Ar address . 271If 272.Ar count 273is supplied, continues 274.Pq Ar count Ns -1 275times before stopping at the breakpoint. 276If the breakpoint is set, a breakpoint number is printed with 277.Sq \&# . 278This number can be used to 279.Ic delete 280the breakpoint, or to add 281conditions to it. 282.Pp 283If 284.Cm /u 285is specified, 286set a breakpoint at a user-space address. 287Without 288.Cm /u , 289.Ar address 290is considered to be in the kernel-space, and an address in the wrong 291space will be rejected, and an error message will be emitted. 292This modifier may only be used if it is supported by machine dependent 293routines. 294.Pp 295Warning: if a user text is shadowed by a normal user-space debugger, 296user-space breakpoints may not work correctly. 297Setting a breakpoint at the low-level code paths may also cause 298strange behavior. 299.It Xo 300.Ic bt Ns Op Cm /u 301.Sm off 302.Op Ar frame-address 303.Op Cm , Ar count 304.Sm on 305.Xc 306A synonym for 307.Ic trace . 308.It Xo 309.Ic bt/t 310.Sm off 311.Op Ar pid 312.Op Cm , Ar count 313.Sm on 314.Xc 315A synonym for 316.Ic trace . 317.It Xo 318.Ic call 319.Sm off 320.Ar address 321.Oo 322.Cm ( Ar expression 323.Op Ar ,... 324.Cm ) 325.Oc 326.Sm on 327.Xc 328Call the function specified by 329.Ar address 330with the argument(s) listed in parentheses. 331Parentheses may be omitted if the function takes no arguments. 332The number of arguments is currently limited to 10. 333.It Ic continue Ns Op Cm /c 334Continue execution until a breakpoint or watchpoint. 335If 336.Cm /c 337is specified, count instructions while executing. 338Some machines (e.g., pmax) also count loads and stores. 339.Pp 340Warning: when counting, the debugger is really silently 341single-stepping. 342This means that single-stepping on low-level may cause strange 343behavior. 344.It Xo 345.Ic delete 346.Ar "address" | 347.Cm # Ns Ar number 348.Xc 349Delete a breakpoint. 350The target breakpoint may be specified by 351.Ar address , 352as per 353.Ic break , 354or by the breakpoint number returned by 355.Ic break 356if it's prefixed with 357.Sq Cm \&# . 358.It Xo 359.Ic dwatch 360.Ar address 361.Xc 362Delete the watchpoint at 363.Ar address 364that was previously set with 365.Ic watch 366command. 367.It Xo 368.Ic examine Ns Op Cm / Ns Ar modifier 369.Ar address Ns Op Cm , Ns Ar count 370.Xc 371Display the address locations according to the format in 372.Ar modifier . 373Multiple modifier formats display multiple locations. 374If 375.Ar modifier 376isn't specified, the modifier from the last use of 377.Ic examine 378is used. 379.Pp 380The valid format characters for 381.Ar modifier 382are: 383.Bl -tag -offset indent -width 2n -compact 384.It Cm b 385examine bytes (8 bits). 386.It Cm h 387examine half-words (16 bits). 388.It Cm l 389examine words (legacy 390.Dq long , 39132 bits). 392.It Cm L 393examine long words (implementation dependent) 394.It Cm a 395print the location being examined. 396.It Cm A 397print the location with a line number if possible. 398.It Cm x 399display in unsigned hex. 400.It Cm z 401display in signed hex. 402.It Cm o 403display in unsigned octal. 404.It Cm d 405display in signed decimal. 406.It Cm u 407display in unsigned decimal. 408.It Cm r 409display in current radix, signed. 410.It Cm c 411display low 8 bits as a character. 412Non-printing characters as displayed as an octal escape code 413(e.g., 414.Sq \e000 ) . 415.It Cm s 416display the NUL terminated string at the location. 417Non-printing characters are displayed as octal escapes. 418.It Cm m 419display in unsigned hex with a character dump at the end of each line. 420The location is displayed as hex at the beginning of each line. 421.It Cm i 422display as a machine instruction. 423.It Cm I 424display as a machine instruction, with possible alternative formats 425depending upon the machine: 426.Bl -tag -offset indent -width "sparc" -compact 427.It alpha 428print register operands 429.It m68k 430use Motorola syntax 431.It pc532 432print instruction bytes in hex 433.It vax 434don't assume that each external label is a procedure entry mask 435.El 436.El 437.It Xo 438.Ic kill 439.Ar pid Ns Op Cm , Ns Ar signal_number 440.Xc 441Send a signal to the process specified by the 442.Ar pid . 443Note that 444.Ar pid 445is interpreted using the current radix (see 446.Cm trace/t 447command for details). 448If 449.Ar signal_number 450isn't specified, the SIGTERM signal is sent. 451.It Ic match Ns Op Cm /p 452A synonym for 453.Ic next . 454.It Ic next Ns Op Cm /p 455Stop at the matching return instruction. 456If 457.Cm /p 458is specified, print the call nesting depth and the 459cumulative instruction count at each call or return. 460Otherwise, only print when the matching return is hit. 461.It Xo 462.Ic print Ns Op Cm /axzodurc 463.Ar address Op Ar address ... 464.Xc 465Print addresses 466.Ar address 467according to the modifier character, as per 468.Ic examine . 469Valid modifiers are: 470.Cm /a , 471.Cm /x , 472.Cm /z , 473.Cm /o , 474.Cm /d , 475.Cm /u , 476.Cm /r , 477and 478.Cm /c 479(as per 480.Ic examine ) . 481If no modifier is specified, the most recent one specified is used. 482.Ar address 483may be a string, and is printed 484.Dq as-is . 485For example: 486.Bd -literal -offset indent 487print/x "eax = " $eax "\enecx = " $ecx "\en" 488.Ed 489.Pp 490will produce: 491.Bd -literal -offset indent 492eax = xxxxxx 493ecx = yyyyyy 494.Ed 495.It Xo 496.Sm off 497.Ic ps 498.Op Cm /a 499.Op Cm /n 500.Op Cm /w 501.Sm on 502.Xc 503A synonym for 504.Ic "show all procs" . 505.It Ic reboot Op Ar flags 506Reboot, using the optionally supplied boot 507.Ar flags . 508.Pp 509Note: Limitations of the command line interface preclude 510specification of a boot string. 511.It Xo 512.Ic search Ns Op Cm /bhl 513.Ar address 514.Ar value 515.Op Ar mask 516.Op Cm , Ns Ar count 517.Xc 518Search memory from 519.Ar address 520for 521.Ar value . 522The unit size is specified with a modifier character, as per 523.Ic examine . 524Valid modifiers are: 525.Cm /b , 526.Cm /h , 527and 528.Cm /l . 529If no modifier is specified, 530.Cm /l 531is used. 532.Pp 533This command might fail in interesting ways if it doesn't find 534.Ar value . 535This is because 536.Nm 537doesn't always recover from touching bad memory. 538The optional 539.Ar count 540limits the search. 541.It Xo 542.Ic set 543.Cm $ Ns Ar variable 544.Op Cm = 545.Ar expression 546.Xc 547Set the named variable or register to the value of 548.Ar expression . 549Valid variable names are described in 550.Sx VARIABLES . 551.It Xo 552.Sm off 553.Ic "show\ all\ procs" 554.Op Cm /a 555.Op Cm /n 556.Op Cm /w 557.Sm on 558.Xc 559Display all process information. 560Valid modifiers: 561.Bl -tag -width 3n 562.It Cm /n 563show process information in a 564.Xr ps 1 565style format (this is the default). 566Information printed includes: process ID, parent process ID, 567process group, UID, process status, process flags, process 568command name, and process wait channel message. 569.It Cm /a 570show the kernel virtual addresses of each process' 571proc structure, u-area, and vmspace structure. 572The vmspace address is also the address of the process' 573vm_map structure, and can be used in the 574.Ic "show map" 575command. 576.It Cm /w 577show each process' PID, command, system call emulation, wait channel 578address, and wait channel message. 579.El 580.It Ic "show breaks" 581Display all breakpoints. 582.It Xo 583.Ic "show buf" Ns Op Cm /f 584.Ar address 585.Xc 586Print the struct buf at 587.Ar address . 588The 589.Cm /f 590does nothing at this time. 591.It Xo 592.Ic "show event" Ns Op Cm /f 593.Xc 594Print all the non-zero 595.Xr evcnt 9 596event counters. 597If 598.Cm /f 599is specified, all event counters with a count of zero are printed as well. 600.It Xo 601.Ic "show map" Ns Op Cm /f 602.Ar address 603.Xc 604Print the vm_map at 605.Ar address . 606If 607.Cm /f 608is specified, the complete map is printed. 609.It Ic "show ncache" Ar address 610Dump the namecache list associated with vnode at 611.Ar address . 612.It Xo 613.Ic "show object" Ns Op Cm /f 614.Ar address 615.Xc 616Print the vm_object at 617.Ar address . 618If 619.Cm /f 620is specified, the complete object is printed. 621.It Xo 622.Ic "show page" Ns Op Cm /f 623.Ar address 624.Xc 625Print the vm_page at 626.Ar address . 627If 628.Cm /f 629is specified, the complete page is printed. 630.It Xo 631.Ic "show pool" Ns Op Cm /clp 632.Ar address 633.Xc 634Print the pool at 635.Ar address . 636Valid modifiers: 637.Bl -tag -width 4n -compact 638.It Cm /c 639Print the cachelist and its statistics for this pool. 640.It Cm /l 641Print the log entries for this pool. 642.It Cm /p 643Print the pagelist for this pool. 644.El 645.It Ic "show registers" Ns Op Cm /u 646Display the register set. 647If 648.Cm /u 649is specified, display user registers instead of kernel registers 650or the currently save one. 651.Pp 652Warning: support for 653.Cm /u 654is machine dependent. 655If not supported, incorrect information will be displayed. 656.It Ic "show uvmexp" 657Print a selection of UVM counters and statistics. 658.It Xo 659.Ic "show vnode" Ns Op Cm /f 660.Ar address 661.Xc 662Print the vnode at 663.Ar address . 664If 665.Cm /f 666is specified, the complete vnode is printed. 667.It Ic "show watches" 668Display all watchpoints. 669.It Xo 670.Ic sifting Ns Op Cm /F 671.Ar string 672.Xc 673Search the symbol tables for all symbols of which 674.Ar string 675is a substring, and display them. If 676.Cm /F 677is specified, a character is displayed immediately after each symbol 678name indicating the type of symbol. 679.Pp 680For 681.Ns Xr a.out 5 -format 682symbol tables, 683absolute symbols display 684.Sy @ , 685text segment symbols display 686.Sy * , 687data segment symbols display 688.Sy + , 689.Tn BSS 690segment symbols display 691.Sy - , 692and filename symbols display 693.Sy / . 694For 695.Tn ELF Ns -format 696symbol tables, 697object symbols display 698.Sy + , 699function symbols display 700.Sy * , 701section symbols display 702.Sy \*[Am] , 703and file symbols display 704.Sy / . 705.Pp 706To sift for a string beginning with a number, escape the first 707character with a backslash as: 708.Bd -literal -offset indent 709sifting \\386 710.Ed 711.It Xo 712.Ic step Ns Op Cm /p 713.Op Cm , Ns Ar count 714.Xc 715Single-step 716.Ar count 717times. 718If 719.Cm /p 720is specified, print each instruction at each step. 721Otherwise, only print the last instruction. 722.Pp 723Warning: depending on the machine type, it may not be possible 724to single-step through some low-level code paths or user-space 725code. 726On machines with software-emulated single-stepping (e.g., pmax), 727stepping through code executed by interrupt handlers will probably 728do the wrong thing. 729.It Ic sync 730Force a crash dump, and then reboot. 731.It Xo 732.Ic trace Ns Op Cm /u 733.Sm off 734.Op Ar frame-address 735.Op Cm , Ar count 736.Sm on 737.Xc 738Stack trace from 739.Ar frame-address . 740If 741.Cm /u 742is specified, trace user-space, otherwise trace kernel-space. 743.Ar count 744is the number of frames to be traced. 745If 746.Ar count 747is omitted, all frames are printed. 748.Pp 749Warning: user-space stack trace is valid only if the machine dependent 750code supports it. 751.It Xo 752.Ic trace/t 753.Sm off 754.Op Ar pid 755.Op Cm , Ar count 756.Sm on 757.Xc 758Stack trace by 759.Dq thread 760(process, on 761.Nx ) 762rather than by stack frame address. 763Note that 764.Ar pid 765is interpreted using the current radix, whilst 766.Ic ps 767displays pids in decimal; prefix 768.Ar pid 769with 770.Sq 0t 771to force it to be interpreted as decimal (see 772.Sx VARIABLES 773section for radix) 774.Pp 775Warning: trace by pid is valid only if the machine dependent code 776supports it. 777.It Ic until Ns Op Cm /p 778Stop at the next call or return instruction. 779If 780.Cm /p 781is specified, print the call nesting depth and the 782cumulative instruction count at each call or return. 783Otherwise, only print when the matching return is hit. 784.It Xo 785.Ic watch 786.Sm off 787.Ar address 788.Op Cm , Ar size 789.Sm on 790.Xc 791Set a watchpoint for a region. 792Execution stops when an attempt to modify the region occurs. 793.Ar size 794defaults to 4. 795.Pp 796If you specify a wrong space address, the request is 797rejected with an error message. 798.Pp 799Warning: attempts to watch wired kernel memory may cause 800an unrecoverable error in some systems such as i386. 801Watchpoints on user addresses work the best. 802.It Xo 803.Ic write Ns Op Cm /bhl 804.Ar address 805.Ar expression Op Ar expression ... 806.Xc 807Write the 808.Ar expression Ns s 809at succeeding locations. 810The unit size is specified with a modifier character, as per 811.Ic examine . 812Valid modifiers are: 813.Cm /b , 814.Cm /h , 815and 816.Cm /l . 817If no modifier is specified, 818.Cm /l 819is used. 820.Pp 821Warning: since there is no delimiter between 822.Ar expression Ns s , 823strange things may occur. 824It's best to enclose each 825.Ar expression 826in parentheses. 827.It Xo 828.Ic x Ns Op Cm / Ns Ar modifier 829.Ar address Ns Op Cm , Ns Ar count 830.Xc 831A synonym for 832.Ic examine . 833.\" XXX - these commands aren't implemented; jhawk 19 May 2000 834.\" .It Ic xf 835.\" Examine forward. 836.\" .Ic xf 837.\" re-executes the most recent 838.\" .Ic execute 839.\" command with the same parameters except that 840.\" .Ar address 841.\" is set to 842.\" .Ar next . 843.\" .It Ic xb 844.\" Examine backward. 845.\" .Ic xb 846.\" re-executes the most recent 847.\" .Ic execute 848.\" command with the same parameters, except that 849.\" .Ar address 850.\" is set to the last start address minus its size. 851.El 852.Sh MACHINE-SPECIFIC COMMANDS 853The "glue" code that hooks 854.Nm 855into the 856.Nx 857kernel for any given port can also add machine specific commands 858to the 859.Nm 860command parser. 861All of these commands are preceded by the command word 862.Em machine 863to indicate that they are part of the machine-specific command 864set (e.g. 865.Ic "machine reboot" ) . 866Some of these commands are: 867.Ss ALPHA 868.Bl -tag -width "intrchain" -compact 869.It Ic halt 870Call the PROM monitor to halt the CPU. 871.It Ic reboot 872Call the PROM monitor to reboot the CPU. 873.El 874.Ss ARM32 875.Bl -tag -width "intrchain" -compact 876.It Ic vmstat 877Equivalent to 878.Xr vmstat 1 879output with "-s" option (statistics). 880.It Ic vnode 881Print out a description of a vnode. 882.It Ic intrchain 883Print the list of IRQ handlers. 884.It Ic panic 885Print the current "panic" string. 886.It Ic frame 887Given a trap frame address, print out the trap frame. 888.El 889.Ss MIPS 890.Bl -tag -width "intrchain" -compact 891.It Ic kvtop 892Print the physical address for a given kernel virtual address. 893.It Ic tlb 894Print out the Translation Lookaside Buffer (TLB). 895Only works in 896.Nx 897kernels compiled with 898.Dv DEBUG 899option. 900.El 901.Ss SH3 902.Bl -tag -width "intrchain" -compact 903.It Ic tlb 904Print TLB entries 905.It Ic cache 906Print cache entries 907.It Ic frame 908Print switch frame and trap frames. 909.It Ic stack 910Print kernel stack usage. Only works in NetBSD kernels compiled with 911KSTACK_DEBUG option. 912.El 913.Ss SPARC 914.Bl -tag -width "intrchain" -compact 915.It Ic prom 916Exit to the Sun PROM monitor. 917.El 918.Ss SPARC64 919.Bl -tag -width "intrchain" -compact 920.It Ic buf 921Print buffer information. 922.It Ic ctx 923Print process context information. 924.It Ic dtlb 925Print data translation look-aside buffer context information. 926.It Ic dtsb 927Display data translation storage buffer information. 928.It Ic kmap 929Display information about the listed mapping in the kernel pmap. Use the 930.Dq f 931modifier to get a full listing. 932.It Ic pcb 933Display information about the 934.Dq struct pcb 935listed. 936.It Ic pctx 937Attempt to change process context. 938.It Ic page 939Display the pointer to the 940.Dq struct vm_page 941for this physical address. 942.It Ic phys 943Display physical memory. 944.It Ic pmap 945Display the pmap. Use the 946.Dq f 947modifier to get a fuller listing. 948.It Ic proc 949Display some information about the process pointed to, or curproc. 950.It Ic prom 951Enter the OFW PROM. 952.It Ic pv 953Display the 954.Dq struct pv_entry 955pointed to. 956.It Ic stack 957Dump the window stack. Use the 958.Dq u 959modifier to get userland information. 960.It Ic tf 961Display full trap frame state. This is most useful for inclusion with 962bug reports. 963.It Ic ts 964Display trap state. 965.It Ic traptrace 966Display or set trap trace information. Use the 967.Dq r 968and 969.Dq f 970modifiers to get reversed and full information, respectively. 971.It Ic uvmdump 972Dumps the UVM histories. 973.It Ic watch 974Set or clear a physical or virtual hardware watchpoint. Pass the address 975to be watched, or 976.Dq 0 977to clear the watchpoint. Append 978.Dq p 979to the watch point to use the physical watchpoint registers. 980.It Ic window 981Print register window information about given address. 982.El 983.Ss SUN3 and SUN3X 984.Bl -tag -width "intrchain" -compact 985.It Ic abort 986Drop into monitor via abort (allows continue). 987.It Ic halt 988Exit to Sun PROM monitor as in 989.Xr halt 8 . 990.It Ic reboot 991Reboot the machine as in 992.Xr reboot 8 . 993.It Ic pgmap 994Given an address, print the address, segment map, page map, and 995Page Table Entry (PTE). 996.El 997.Sh VARIABLES 998.Nm 999accesses registers and variables as 1000.Cm $ Ns Ar name . 1001Register names are as per the 1002.Ic "show registers" 1003command. 1004Some variables are suffixed with numbers, and may have a modifier 1005following a colon immediately after the variable name. 1006For example, register variables may have a 1007.Sq u 1008modifier to indicate user register 1009(e.g., 1010.Li "$eax:u" ) . 1011.Pp 1012Built-in variables currently supported are: 1013.Bl -tag -offset indent -width "maxwidth" -compact 1014.It Va lines 1015The number of lines. 1016This is used by the 1017.Ic more 1018feature. 1019.It Va maxoff 1020Addresses are printed as 1021.Li 'symbol'+offset 1022unless 1023.Li offset 1024is greater than 1025.Va maxoff . 1026.It Va maxwidth 1027The width of the displayed line. 1028.It Va onpanic 1029If non-zero (the default), 1030.Nm 1031will be invoked when the kernel panics. 1032If the kernel configuration option 1033.D1 Cd options DDB_ONPANIC=0 1034is used, 1035.Va onpanic 1036will be initialized to off. 1037.It Va fromconsole 1038If non-zero (the default), 1039the kernel allows to enter 1040.Nm 1041from the console (by break signal or special key sequence). 1042If the kernel configuration option 1043.D1 Cd options DDB_FROMCONSOLE=0 1044is used, 1045.Va fromconsole 1046will be initialized to off. 1047.It Va radix 1048Input and output radix. 1049.It Va tabstops 1050Tab stop width. 1051.\" .It Va work Ns Sy xx 1052.\" Temporary work variable. 1053.\" .Sq Sy xx 1054.\" is between 0 and 31. 1055.El 1056.Pp 1057All built-in variables are accessible via 1058.Xr sysctl 3 . 1059.Sh EXPRESSIONS 1060Almost all expression operators in C are supported, except 1061.Sq \&~ , 1062.Sq \&^ , 1063and unary 1064.Sq \&\*[Am] . 1065Special rules in 1066.Nm 1067are: 1068.Bl -tag -offset indent -width "identifier" 1069.It Ar identifier 1070name of a symbol. 1071It is translated to the address (or value) of it. 1072.Sq \&. 1073and 1074.Sq \&: 1075can be used in the identifier. 1076If supported by an object format dependent routine, 1077.Sm off 1078.Xo 1079.Oo Ar filename : Oc 1080.Ar function 1081.Oo : Ar "line number" Oc , 1082.Xc 1083.Xo 1084.Oo Ar filename : Oc 1085.Ar variable , 1086.Xc 1087and 1088.Xo 1089.Ar filename 1090.Oo : Ar "line number" Oc , 1091.Xc 1092.Sm on 1093can be accepted as a symbol. 1094The symbol may be prefixed with 1095.Ar symbol_table_name : : 1096(e.g., 1097.Li emulator::mach_msg_trap ) 1098to specify other than kernel symbols. 1099.It Ar number 1100number. 1101Radix is determined by the first two characters: 1102.Sq 0x 1103- hex, 1104.Sq 0o 1105- octal, 1106.Sq 0t 1107- decimal, 1108otherwise follow current radix. 1109.It Cm . 1110.Ar dot 1111.It Cm + 1112.Ar next 1113.It Cm .. 1114address of the start of the last line examined. 1115Unlike 1116.Ar dot 1117or 1118.Ar next , 1119this is only changed by the 1120.Ic examine 1121or 1122.Ic write 1123commands. 1124.It Cm \&" 1125last address explicitly specified. 1126.It Cm $ Ns Ar name 1127register name or variable. 1128It is translated to the value of it. 1129It may be followed by a 1130.Sq \&: 1131and modifiers as described above. 1132.It Cm a 1133multiple of right-hand side. 1134.It Cm * Ns Ar expr 1135expression indirection. 1136It may be followed by a 1137.Sq \&: 1138and modifiers as described above. 1139.El 1140.Sh SEE ALSO 1141.Xr options 4 , 1142.Xr sysctl 8 1143.Sh HISTORY 1144The 1145.Nm 1146kernel debugger was written as part of the MACH project at 1147Carnegie-Mellon University. 1148