1.\" $NetBSD: ddb.4,v 1.53 2001/09/12 18:35:28 wiz Exp $ 2.\" 3.\" Copyright (c) 1997 - 2001 The NetBSD Foundation, Inc. 4.\" All rights reserved. 5.\" 6.\" This code is derived from software contributed to The NetBSD Foundation 7.\" by Luke Mewburn 8.\" 9.\" Redistribution and use in source and binary forms, with or without 10.\" modification, are permitted provided that the following conditions 11.\" are met: 12.\" 1. Redistributions of source code must retain the above copyright 13.\" notice, this list of conditions and the following disclaimer. 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 3. All advertising materials mentioning features or use of this software 18.\" must display the following acknowledgement: 19.\" This product includes software developed by the NetBSD 20.\" Foundation, Inc. and its contributors. 21.\" 4. Neither the name of The NetBSD Foundation nor the names of its 22.\" contributors may be used to endorse or promote products derived 23.\" from this software without specific prior written permission. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 26.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 27.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 28.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 29.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 30.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 31.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 32.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 33.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 34.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 35.\" POSSIBILITY OF SUCH DAMAGE. 36.\" 37.\" --- 38.\" This manual page was derived from a -man.old document which bore 39.\" the following copyright message: 40.\" --- 41.\" 42.\" Mach Operating System 43.\" Copyright (c) 1991,1990 Carnegie Mellon University 44.\" All Rights Reserved. 45.\" 46.\" Permission to use, copy, modify and distribute this software and its 47.\" documentation is hereby granted, provided that both the copyright 48.\" notice and this permission notice appear in all copies of the 49.\" software, derivative works or modified versions, and any portions 50.\" thereof, and that both notices appear in supporting documentation. 51.\" 52.\" CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS" 53.\" CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR 54.\" ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE. 55.\" 56.\" Carnegie Mellon requests users of this software to return to 57.\" 58.\" Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU 59.\" School of Computer Science 60.\" Carnegie Mellon University 61.\" Pittsburgh PA 15213-3890 62.\" 63.\" any improvements or extensions that they make and grant Carnegie Mellon 64.\" the rights to redistribute these changes. 65.\" 66.Dd February 11, 2001 67.Dt DDB 4 68.Os 69.Sh NAME 70.Nm ddb 71.Nd in-kernel debugger 72.Sh SYNOPSIS 73.Cd options DDB 74.Pp 75To enable history editing: 76.Cd options DDB_HISTORY_SIZE=integer 77.Pp 78To disable entering 79.Nm 80upon kernel panic: 81.Cd options DDB_ONPANIC=0 82.Sh DESCRIPTION 83.Nm 84is the in-kernel debugger. 85It may be entered at any time via a special key sequence, and 86optionally may be invoked when the kernel panics. 87.Sh ENTERING THE DEBUGGER 88Unless 89.Dv DDB_ONPANIC 90is set to 0, 91.Nm 92will be activated whenever the kernel would otherwise panic. 93.Pp 94.Nm 95may also be activated from the console. 96In general, sending a break on a serial console will activate 97.Nm "" . 98There are also key sequences for each port that will activate 99.Nm 100from the keyboard: 101.Bl -tag -offset indent -width "mvme68k" -compact 102.It alpha 103<Ctrl>-<Alt>-<Esc> on PC style keyboards. 104.It amiga 105<LAlt>-<LAmiga>-<F10> 106.It atari 107<Alt>-<LeftShift>-<F9> 108.It hp300 109<Shift>-<Reset> 110.It hpcmips 111<Ctrl>-<Alt>-<Esc> 112.It i386 113<Ctrl>-<Alt>-<Esc> 114.br 115<Break> on serial console. 116.It mac68k 117<Command>-<Power>, or the Interrupt switch. 118.It mvme68k 119Abort switch on CPU card. 120.It pmax 121<Do> on 122.Tn LK-201 123rcons console. 124.br 125<Break> on serial console. 126.It sparc 127<L1>-A, or <Stop>-A on a 128.Tn Sun 129keyboard. 130.br 131<Break> on serial console. 132.It sun3 133<L1>-A, or <Stop>-A on a 134.Tn Sun 135keyboard. 136.br 137<Break> on serial console. 138.It sun3x 139<L1>-A, or <Stop>-A on a 140.Tn Sun 141keyboard. 142.br 143<Break> on serial console. 144.It x68k 145Interrupt switch on the body. 146.El 147.Pp 148In addition, 149.Nm 150may be explicitly activated by the debugging code in the kernel 151if 152.Cm DDB 153is configured. 154.Sh COMMAND SYNTAX 155The general command syntax is: 156.Bd -ragged -offset indent 157.Ic command Ns Op Cm / Ns Ar modifier 158.Ar address 159.Op Cm , Ns Ar count 160.Ed 161.Pp 162The current memory location being edited is referred to as 163.Ar dot , 164and the next location is 165.Ar next . 166They are displayed as hexadecimal numbers. 167.Pp 168Commands that examine and/or modify memory update 169.Ar dot 170to the address of the last line examined or the last location 171modified, and set 172.Ar next 173to the next location to be examined or modified. 174Other commands don't change 175.Ar dot , 176and set 177.Ar next 178to be the same as 179.Ar dot . 180.Pp 181A blank line repeats the previous command from the address 182.Ar next 183with the previous 184.Cm count 185and no modifiers. 186Specifying 187.Cm address 188sets 189.Em dot 190to the address. 191If 192.Cm address 193is omitted, 194.Em dot 195is used. 196A missing 197.Cm count 198is taken to be 1 for printing commands, and infinity for stack traces. 199.Pp 200The syntax: 201.Bd -ragged -offset indent 202.Ic Cm , Ns Ar count 203.Ed 204.Pp 205repeats the previous command, just as a blank line does, but with 206the specified 207.Cm count . 208.Pp 209.Nm 210has a 211.Xr more 1 -like 212functionality; if a number of lines in a command's output exceeds the number 213defined in the 214.Va lines 215variable, then 216.Nm 217displays 218.Dq "--db more--" 219and waits for a response, which may be one of: 220.Bl -tag -offset indent -width "<return>" 221.It <return> 222one more line. 223.It <space> 224one more page. 225.It Ic q 226abort the current command, and return to the command input mode. 227.El 228.Pp 229If 230.Nm 231history editing is enabled (by defining the 232.D1 Cd options DDB_HISTORY_SIZE=num 233kernel option), then a history of the last 234.Cm num 235commands is kept. 236The history can be manipulated with the following key sequences: 237.Bl -tag -offset indent -width "<Ctrl>-P" 238.It <Ctrl>-P 239retrieve previous command in history (if any). 240.It <Ctrl>-N 241retrieve next command in history (if any). 242.El 243.Sh COMMANDS 244.Nm 245supports the following commands: 246.Bl -tag -width 5n 247.It Xo 248.Sm off 249.Ic ! 250.Ar address 251.Oo 252.Cm ( Ar expression 253.Op Ar ,... 254.Cm ) 255.Oc 256.Sm on 257.Xc 258A synonym for 259.Ic call . 260.It Xo 261.Ic break Ns Op Cm /u 262.Ar address Ns Op Cm , Ns Ar count 263.Xc 264Set a breakpoint at 265.Ar address . 266If 267.Ar count 268is supplied, continues 269.Pq Ar count Ns -1 270times before stopping at the breakpoint. 271If the breakpoint is set, a breakpoint number is printed with 272.Sq \&# . 273This number can be used to 274.Ic delete 275the breakpoint, or to add 276conditions to it. 277.Pp 278If 279.Cm /u 280is specified, 281set a breakpoint at a user-space address. 282Without 283.Cm /u , 284.Ar address 285is considered to be in the kernel-space, and an address in the wrong 286space will be rejected, and an error message will be emitted. 287This modifier may only be used if it is supported by machine dependent 288routines. 289.Pp 290Warning: if a user text is shadowed by a normal user-space debugger, 291user-space breakpoints may not work correctly. 292Setting a breakpoint at the low-level code paths may also cause 293strange behavior. 294.It Xo 295.Ic call 296.Sm off 297.Ar address 298.Oo 299.Cm ( Ar expression 300.Op Ar ,... 301.Cm ) 302.Oc 303.Sm on 304.Xc 305Call the function specified by 306.Ar address 307with the argument(s) listed in parentheses. 308Parentheses may be omitted if the function takes no arguments. 309The number of arguments is currently limited to 10. 310.It Ic continue Ns Op Cm /c 311Continue execution until a breakpoint or watchpoint. 312If 313.Cm /c 314is specified, count instructions while executing. 315Some machines (e.g., pmax) also count loads and stores. 316.Pp 317Warning: when counting, the debugger is really silently 318single-stepping. 319This means that single-stepping on low-level may cause strange 320behavior. 321.It Xo 322.Ic delete 323.Ar "address" | 324.Cm # Ns Ar number 325.Xc 326Delete a breakpoint. 327The target breakpoint may be specified by 328.Ar address , 329as per 330.Ic break , 331or by the breakpoint number returned by 332.Ic break 333if it's prefixed with 334.Sq Cm \&# . 335.It Xo 336.Ic dwatch 337.Ar address 338.Xc 339Delete the watchpoint at 340.Ar address 341that was previously set with 342.Ic watch 343command. 344.It Xo 345.Ic examine Ns Op Cm / Ns Ar modifier 346.Ar address Ns Op Cm , Ns Ar count 347.Xc 348Display the address locations according to the format in 349.Ar modifier . 350Multiple modifier formats display multiple locations. 351If 352.Ar modifier 353isn't specified, the modifier from the last use of 354.Ic examine 355is used. 356.Pp 357The valid format characters for 358.Ar modifier 359are: 360.Bl -tag -offset indent -width 2n -compact 361.It Cm b 362examine bytes (8 bits). 363.It Cm h 364examine half-words (16 bits). 365.It Cm l 366examine words (legacy 367.Dq long , 36832 bits). 369.It Cm L 370examine long words (implementation dependent) 371.It Cm a 372print the location being examined. 373.It Cm A 374print the location with a line number if possible. 375.It Cm x 376display in unsigned hex. 377.It Cm z 378display in signed hex. 379.It Cm o 380display in unsigned octal. 381.It Cm d 382display in signed decimal. 383.It Cm u 384display in unsigned decimal. 385.It Cm r 386display in current radix, signed. 387.It Cm c 388display low 8 bits as a character. 389Non-printing characters as displayed as an octal escape code 390(e.g., 391.Sq \e000 ) . 392.It Cm s 393display the NUL terminated string at the location. 394Non-printing characters are displayed as octal escapes. 395.It Cm m 396display in unsigned hex with a character dump at the end of each line. 397The location is displayed as hex at the beginning of each line. 398.It Cm i 399display as a machine instruction. 400.It Cm I 401display as a machine instruction, with possible alternative formats 402depending upon the machine: 403.Bl -tag -offset indent -width "sparc" -compact 404.It alpha 405print register operands 406.It m68k 407use Motorola syntax 408.It pc532 409print instruction bytes in hex 410.It vax 411don't assume that each external label is a procedure entry mask 412.El 413.El 414.It Xo 415.Ic kill 416.Ar pid Ns Op Cm , Ns Ar signal_number 417.Xc 418Send a signal to the process specified by the 419.Ar pid . 420Note that 421.Ar pid 422is interpreted using the current radix (see 423.Cm trace/t 424command for details). 425If 426.Ar signal_number 427isn't specified, the SIGTERM signal is sent. 428.It Ic match Ns Op Cm /p 429A synonym for 430.Ic next . 431.It Ic next Ns Op Cm /p 432Stop at the matching return instruction. 433If 434.Cm /p 435is specified, print the call nesting depth and the 436cumulative instruction count at each call or return. 437Otherwise, only print when the matching return is hit. 438.It Xo 439.Ic print Ns Op Cm /axzodurc 440.Ar address Op Ar address ... 441.Xc 442Print addresses 443.Ar address 444according to the modifier character, as per 445.Ic examine . 446Valid modifiers are: 447.Cm /a , 448.Cm /x , 449.Cm /z , 450.Cm /o , 451.Cm /d , 452.Cm /u , 453.Cm /r , 454and 455.Cm /c 456(as per 457.Ic examine ) . 458If no modifier is specified, the most recent one specified is used. 459.Ar address 460may be a string, and is printed 461.Dq as-is . 462For example: 463.Bd -literal -offset indent 464print/x "eax = " $eax "\enecx = " $ecx "\en" 465.Ed 466.Pp 467will produce: 468.Bd -literal -offset indent 469eax = xxxxxx 470ecx = yyyyyy 471.Ed 472.It Xo 473.Sm off 474.Ic ps 475.Op Cm /a 476.Op Cm /n 477.Op Cm /w 478.Sm on 479.Xc 480A synonym for 481.Ic "show all procs" . 482.It Ic reboot Op Ar flags 483Reboot, using the optionally supplied boot 484.Ar flags . 485.Pp 486Note: Limitations of the command line interface preclude 487specification of a boot string. 488.It Xo 489.Ic search Ns Op Cm /bhl 490.Ar address 491.Ar value 492.Op Ar mask 493.Op Cm , Ns Ar count 494.Xc 495Search memory from 496.Ar address 497for 498.Ar value . 499The unit size is specified with a modifier character, as per 500.Ic examine . 501Valid modifiers are: 502.Cm /b , 503.Cm /h , 504and 505.Cm /l . 506If no modifier is specified, 507.Cm /l 508is used. 509.Pp 510This command might fail in interesting ways if it doesn't find 511.Ar value . 512This is because 513.Nm 514doesn't always recover from touching bad memory. 515The optional 516.Ar count 517limits the search. 518.It Xo 519.Ic set 520.Cm $ Ns Ar variable 521.Op Cm = 522.Ar expression 523.Xc 524Set the named variable or register to the value of 525.Ar expression . 526Valid variable names are described in 527.Sx VARIABLES . 528.It Xo 529.Sm off 530.Ic "show\ all\ procs" 531.Op Cm /a 532.Op Cm /n 533.Op Cm /w 534.Sm on 535.Xc 536Display all process information. 537Valid modifiers: 538.Bl -tag -width 3n 539.It Cm /n 540show process information in a 541.Xr ps 1 542style format (this is the default). 543Information printed includes: process ID, parent process ID, 544process group, UID, process status, process flags, process 545command name, and process wait channel message. 546.It Cm /a 547show the kernel virtual addresses of each process' 548proc structure, u-are, and vmspace structure. 549The vmspace address is also the address of the process' 550vm_map structure, and can be used in the 551.Ic "show map" 552command. 553.It Cm /w 554show each process' PID, command, system call emulation, wait channel 555address, and wait channel message. 556.El 557.It Ic "show breaks" 558Display all breakpoints. 559.It Xo 560.Ic "show buf" Ns Op Cm /f 561.Ar address 562.Xc 563Print the struct buf at 564.Ar address . 565The 566.Cm /f 567does nothing at this time. 568.It Xo 569.Ic "show map" Ns Op Cm /f 570.Ar address 571.Xc 572Print the vm_map at 573.Ar address . 574If 575.Cm /f 576is specified, the complete map is printed. 577.It Ic "show ncache" Ar address 578Dump the namecache list associated with vnode at 579.Ar address . 580.It Xo 581.Ic "show object" Ns Op Cm /f 582.Ar address 583.Xc 584Print the vm_object at 585.Ar address . 586If 587.Cm /f 588is specified, the complete object is printed. 589.It Xo 590.Ic "show page" Ns Op Cm /f 591.Ar address 592.Xc 593Print the vm_page at 594.Ar address . 595If 596.Cm /f 597is specified, the complete page is printed. 598.It Xo 599.Ic "show pool" Ns Op Cm /clp 600.Ar address 601.Xc 602Print the pool at 603.Ar address . 604Valid modifiers: 605.Bl -tag -width 4n -compact 606.It Cm /c 607Print the cachelist and its statistics for this pool. 608.It Cm /l 609Print the log entries for this pool. 610.It Cm /p 611Print the pagelist for this pool. 612.El 613.It Ic "show registers" Ns Op Cm /u 614Display the register set. 615If 616.Cm /u 617is specified, display user registers instead of kernel registers 618or the currently save one. 619.Pp 620Warning: support for 621.Cm /u 622is machine dependent. 623If not supported, incorrect information will be displayed. 624.It Ic "show uvmexp" 625Print a selection of UVM counters and statistics. 626.It Xo 627.Ic "show vnode" Ns Op Cm /f 628.Ar address 629.Xc 630Print the vnode at 631.Ar address . 632If 633.Cm /f 634is specified, the complete vnode is printed. 635.It Ic "show watches" 636Display all watchpoints. 637.It Xo 638.Ic sifting Ns Op Cm /F 639.Ar string 640.Xc 641Search the symbol tables for all symbols of which 642.Ar string 643is a substring, and display them. If 644.Cm /F 645is specified, a character is displayed immediately after each symbol 646name indicating the type of symbol. 647.Pp 648For 649.Ns Xr a.out 5 -format 650symbol tables, 651absolute symbols display 652.Sy @ , 653text segment symbols display 654.Sy * , 655data segment symbols display 656.Sy + , 657.Tn BSS 658segment symbols display 659.Sy - , 660and filename symbols display 661.Sy / . 662For 663.Tn ELF Ns -format 664symbol tables, 665object symbols display 666.Sy + , 667function symbols display 668.Sy * , 669section symbols display 670.Sy & , 671and file symbols display 672.Sy / . 673.Pp 674To sift for a string beginning with a number, escape the first 675character with a backslash as: 676.Bd -literal -offset indent 677sifting \\386 678.Ed 679.It Xo 680.Ic step Ns Op Cm /p 681.Op Cm , Ns Ar count 682.Xc 683Single-step 684.Ar count 685times. 686If 687.Cm /p 688is specified, print each instruction at each step. 689Otherwise, only print the last instruction. 690.Pp 691Warning: depending on the machine type, it may not be possible 692to single-step through some low-level code paths or user-space 693code. 694On machines with software-emulated single-stepping (e.g., pmax), 695stepping through code executed by interrupt handlers will probably 696do the wrong thing. 697.It Ic sync 698Force a crash dump, and then reboot. 699.It Xo 700.Ic trace Ns Op Cm /u 701.Sm off 702.Op Ar frame-address 703.Op Cm , Ar count 704.Sm on 705.Xc 706Stack trace from 707.Ar frame-address . 708If 709.Cm /u 710is specified, trace user-space, otherwise trace kernel-space. 711.Ar count 712is the number of frames to be traced. 713If 714.Ar count 715is omitted, all frames are printed. 716.Pp 717Warning: user-space stack trace is valid only if the machine dependent 718code supports it. 719.It Xo 720.Ic trace/t 721.Sm off 722.Op Ar pid 723.Op Cm , Ar count 724.Sm on 725.Xc 726Stack trace by 727.Dq thread 728(process, on 729.Nx ) 730rather than by stack frame address. 731Note that 732.Ar pid 733is interpreted using the current radix, whilst 734.Ic ps 735displays pids in decimal; prefix 736.Ar pid 737with 738.Sq 0t 739to force it to be interpreted as decimal (see 740.Sx VARIABLES 741section for radix) 742.Pp 743Warning: trace by pid is valid only if the machine dependent code 744supports it. 745.It Ic until Ns Op Cm /p 746Stop at the next call or return instruction. 747If 748.Cm /p 749is specified, print the call nesting depth and the 750cumulative instruction count at each call or return. 751Otherwise, only print when the matching return is hit. 752.It Xo 753.Ic watch 754.Sm off 755.Ar address 756.Op Cm , Ar size 757.Sm on 758.Xc 759Set a watchpoint for a region. 760Execution stops when an attempt to modify the region occurs. 761.Ar size 762defaults to 4. 763.Pp 764If you specify a wrong space address, the request is 765rejected with an error message. 766.Pp 767Warning: attempts to watch wired kernel memory may cause 768an unrecoverable error in some systems such as i386. 769Watchpoints on user addresses work the best. 770.It Xo 771.Ic write Ns Op Cm /bhl 772.Ar address 773.Ar expression Op Ar expression ... 774.Xc 775Write the 776.Ar expression Ns s 777at succeeding locations. 778The unit size is specified with a modifier character, as per 779.Ic examine . 780Valid modifiers are: 781.Cm /b , 782.Cm /h , 783and 784.Cm /l . 785If no modifier is specified, 786.Cm /l 787is used. 788.Pp 789Warning: since there is no delimiter between 790.Ar expression Ns s , 791strange things may occur. 792It's best to enclose each 793.Ar expression 794in parentheses. 795.It Xo 796.Ic x Ns Op Cm / Ns Ar modifier 797.Ar address Ns Op Cm , Ns Ar count 798.Xc 799A synonym for 800.Ic examine . 801.\" XXX - these commands aren't implemented; jhawk 19 May 2000 802.\" .It Ic xf 803.\" Examine forward. 804.\" .Ic xf 805.\" re-executes the most recent 806.\" .Ic execute 807.\" command with the same parameters except that 808.\" .Ar address 809.\" is set to 810.\" .Ar next . 811.\" .It Ic xb 812.\" Examine backward. 813.\" .Ic xb 814.\" re-executes the most recent 815.\" .Ic execute 816.\" command with the same parameters, except that 817.\" .Ar address 818.\" is set to the last start address minus its size. 819.El 820.Sh MACHINE-SPECIFIC COMMANDS 821The "glue" code that hooks 822.Nm 823into the 824.Nx 825kernel for any given port can also add machine specific commands 826to the 827.Nm 828command parser. 829All of these commands are preceded by the command word 830.Em machine 831to indicate that they are part of the machine-specific command 832set (e.g. 833.Ic "machine reboot" ) . 834Some of these commands are: 835.Ss ALPHA 836.Bl -tag -width "intrchain" -compact 837.It Ic halt 838Call the PROM monitor to halt the CPU. 839.It Ic reboot 840Call the PROM monitor to reboot the CPU. 841.El 842.Ss ARM32 843.Bl -tag -width "intrchain" -compact 844.It Ic vmstat 845Equivalent to 846.Xr vmstat 1 847output with "-s" option (statistics). 848.It Ic vnode 849Print out a description of a vnode. 850.It Ic intrchain 851Print the list of IRQ handlers. 852.It Ic panic 853Print the current "panic" string. 854.It Ic frame 855Given a trap frame address, print out the trap frame. 856.El 857.Ss MIPS 858.Bl -tag -width "intrchain" -compact 859.It Ic kvtop 860Print the physical address for a given kernel virtual address. 861.It Ic tlb 862Print out the Translation Lookaside Buffer (TLB). 863Only works in 864.Nx 865kernels compiled with 866.Dv DEBUG 867option. 868.El 869.Ss SPARC 870.Bl -tag -width "intrchain" -compact 871.It Ic prom 872Exit to the Sun PROM monitor. 873.El 874.Ss SPARC64 875.Bl -tag -width "intrchain" -compact 876.It Ic buf 877Print buffer information. 878.It Ic ctx 879Print process context information. 880.It Ic dtlb 881Print data translation look-aside buffer context information. 882.It Ic dtsb 883Display data translation storage buffer information. 884.It Ic kmap 885Display information about the listed mapping in the kernel pmap. Use the 886.Dq f 887modifier to get a full listing. 888.It Ic pcb 889Display information about the 890.Dq struct pcb 891listed. 892.It Ic pctx 893Attempt to change process context. 894.It Ic page 895Display the pointer to the 896.Dq struct vm_page 897for this physical address. 898.It Ic phys 899Display physical memory. 900.It Ic pmap 901Display the pmap. Use the 902.Dq f 903modifier to get a fuller listing. 904.It Ic proc 905Display some information about the process pointed to, or curproc. 906.It Ic prom 907Enter the OFW prom. 908.It Ic pv 909Display the 910.Dq struct pv_entry 911pointed to. 912.It Ic stack 913Dump the window stack. Use the 914.Dq u 915modifier to get userland information. 916.It Ic tf 917Display full trap frame state. This is most useful for inclusion with 918bug reports. 919.It Ic ts 920Display trap state. 921.It Ic traptrace 922Display or set trap trace information. Use the 923.Dq r 924and 925.Dq f 926modifiers to get reversed and full information, respectively. 927.It Ic uvmdump 928Dumps the UVM histories. 929.It Ic watch 930Set or clear a physical or virtual hardware watchpoint. Pass the address 931to be watched, or 932.Dq 0 933to clear the watchpoint. Append 934.Dq p 935to the watch point to use the physical watchpoint registers. 936.It Ic window 937Print register window information about given address. 938.El 939.Ss SUN3 and SUN3X 940.Bl -tag -width "intrchain" -compact 941.It Ic abort 942Drop into monitor via abort (allows continue). 943.It Ic halt 944Exit to Sun PROM monitor as in 945.Xr halt 8 . 946.It Ic reboot 947Reboot the machine as in 948.Xr reboot 8 . 949.It Ic pgmap 950Given an address, print the address, segment map, page map, and 951Page Table Entry (PTE). 952.El 953.Sh VARIABLES 954.Nm 955accesses registers and variables as 956.Cm $ Ns Ar name . 957Register names are as per the 958.Ic "show registers" 959command. 960Some variables are suffixed with numbers, and may have a modifier 961following a colon immediately after the variable name. 962For example, register variables may have a 963.Sq u 964modifier to indicate user register 965(e.g., 966.Li "$eax:u" ) . 967.Pp 968Built-in variables currently supported are: 969.Bl -tag -offset indent -width "maxwidth" -compact 970.It Va lines 971The number of lines. 972This is used by the 973.Ic more 974feature. 975.It Va maxoff 976Addresses are printed as 977.Li 'symbol'+offset 978unless 979.Li offset 980is greater than 981.Va maxoff . 982.It Va maxwidth 983The width of the displayed line. 984.It Va onpanic 985If non-zero (the default), 986.Nm 987will be invoked when the kernel panics. 988If the kernel configuration option 989.D1 Cd options DDB_ONPANIC=0 990is used, 991.Va onpanic 992will be initialized to off. 993.It Va fromconsole 994If non-zero (the default), 995the kernel allows to enter 996.Nm 997from the console (by break signal or special key sequence). 998If the kernel configuration option 999.D1 Cd options DDB_FROMCONSOLE=0 1000is used, 1001.Va fromconsole 1002will be initialized to off. 1003.It Va radix 1004Input and output radix. 1005.It Va tabstops 1006Tab stop width. 1007.It Va work Ns Sy xx 1008Temporary work variable. 1009.Sq Sy xx 1010is between 0 and 31. 1011.El 1012.Pp 1013All built-in variables are accessible via 1014.Xr sysctl 3 . 1015.Sh EXPRESSIONS 1016Almost all expression operators in C are supported, except 1017.Sq \&~ , 1018.Sq \&^ , 1019and unary 1020.Sq \&& . 1021Special rules in 1022.Nm 1023are: 1024.Bl -tag -offset indent -width "identifier" 1025.It Ar identifier 1026name of a symbol. 1027It is translated to the address (or value) of it. 1028.Sq \&. 1029and 1030.Sq \&: 1031can be used in the identifier. 1032If supported by an object format dependent routine, 1033.Sm off 1034.Xo 1035.Oo Ar filename : Oc 1036.Ar function 1037.Oo : Ar "line number" Oc , 1038.Xc 1039.Xo 1040.Oo Ar filename : Oc 1041.Ar variable , 1042.Xc 1043and 1044.Xo 1045.Ar filename 1046.Oo : Ar "line number" Oc , 1047.Xc 1048.Sm on 1049can be accepted as a symbol. 1050The symbol may be prefixed with 1051.Ar symbol_table_name : : 1052(e.g., 1053.Li emulator::mach_msg_trap ) 1054to specify other than kernel symbols. 1055.It Ar number 1056number. 1057Radix is determined by the first two characters: 1058.Sq 0x 1059- hex, 1060.Sq 0o 1061- octal, 1062.Sq 0t 1063- decimal, 1064otherwise follow current radix. 1065.It Cm . 1066.Ar dot 1067.It Cm + 1068.Ar next 1069.It Cm .. 1070address of the start of the last line examined. 1071Unlike 1072.Ar dot 1073or 1074.Ar next , 1075this is only changed by the 1076.Ic examine 1077or 1078.Ic write 1079commands. 1080.It Cm \&" 1081last address explicitly specified. 1082.It Cm $ Ns Ar name 1083register name or variable. 1084It is translated to the value of it. 1085It may be followed by a 1086.Sq \&: 1087and modifiers as described above. 1088.It Cm a 1089multiple of right-hand side. 1090.It Cm * Ns Ar expr 1091expression indirection. 1092It may be followed by a 1093.Sq \&: 1094and modifiers as described above. 1095.El 1096.Sh SEE ALSO 1097.Xr options 4 , 1098.Xr sysctl 8 1099.Sh HISTORY 1100The 1101.Nm 1102kernel debugger was written as part of the MACH project at 1103Carnegie-Mellon University. 1104