1.\" $NetBSD: ddb.4,v 1.52 2001/05/06 23:48:32 wiz Exp $ 2.\" 3.\" Copyright (c) 1997 - 2001 The NetBSD Foundation, Inc. 4.\" All rights reserved. 5.\" 6.\" This code is derived from software contributed to The NetBSD Foundation 7.\" by Luke Mewburn 8.\" 9.\" Redistribution and use in source and binary forms, with or without 10.\" modification, are permitted provided that the following conditions 11.\" are met: 12.\" 1. Redistributions of source code must retain the above copyright 13.\" notice, this list of conditions and the following disclaimer. 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 3. All advertising materials mentioning features or use of this software 18.\" must display the following acknowledgement: 19.\" This product includes software developed by the NetBSD 20.\" Foundation, Inc. and its contributors. 21.\" 4. Neither the name of The NetBSD Foundation nor the names of its 22.\" contributors may be used to endorse or promote products derived 23.\" from this software without specific prior written permission. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 26.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 27.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 28.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 29.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 30.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 31.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 32.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 33.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 34.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 35.\" POSSIBILITY OF SUCH DAMAGE. 36.\" 37.\" --- 38.\" This manual page was derived from a -man.old document which bore 39.\" the following copyright message: 40.\" --- 41.\" 42.\" Mach Operating System 43.\" Copyright (c) 1991,1990 Carnegie Mellon University 44.\" All Rights Reserved. 45.\" 46.\" Permission to use, copy, modify and distribute this software and its 47.\" documentation is hereby granted, provided that both the copyright 48.\" notice and this permission notice appear in all copies of the 49.\" software, derivative works or modified versions, and any portions 50.\" thereof, and that both notices appear in supporting documentation. 51.\" 52.\" CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS" 53.\" CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR 54.\" ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE. 55.\" 56.\" Carnegie Mellon requests users of this software to return to 57.\" 58.\" Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU 59.\" School of Computer Science 60.\" Carnegie Mellon University 61.\" Pittsburgh PA 15213-3890 62.\" 63.\" any improvements or extensions that they make and grant Carnegie Mellon 64.\" the rights to redistribute these changes. 65.\" 66.Dd February 11, 2001 67.Dt DDB 4 68.Os 69.Sh NAME 70.Nm ddb 71.Nd in-kernel debugger 72.Sh SYNOPSIS 73.Cd options DDB 74.Pp 75To enable history editing: 76.Cd options DDB_HISTORY_SIZE=integer 77.Pp 78To disable entering 79.Nm 80upon kernel panic: 81.Cd options DDB_ONPANIC=0 82.Sh DESCRIPTION 83.Nm 84is the in-kernel debugger. 85It may be entered at any time via a special key sequence, and 86optionally may be invoked when the kernel panics. 87.Sh ENTERING THE DEBUGGER 88Unless 89.Dv DDB_ONPANIC 90is set to 0, 91.Nm 92will be activated whenever the kernel would otherwise panic. 93.Pp 94.Nm 95may also be activated from the console. 96In general, sending a break on a serial console will activate 97.Nm "" . 98There are also key sequences for each port that will activate 99.Nm 100from the keyboard: 101.Bl -tag -offset indent -width "mvme68k" -compact 102.It alpha 103<Ctrl>-<Alt>-<Esc> on PC style keyboards. 104.It amiga 105<LAlt>-<LAmiga>-<F10> 106.It atari 107<Alt>-<LeftShift>-<F9> 108.It hp300 109<Shift>-<Reset> 110.It hpcmips 111<Ctrl>-<Alt>-<Esc> 112.It i386 113<Ctrl>-<Alt>-<Esc> 114.br 115<Break> on serial console. 116.It mac68k 117<Command>-<Power>, or the Interrupt switch. 118.It mvme68k 119Abort switch on CPU card. 120.It pmax 121<Do> on 122.Tn LK-201 123rcons console. 124.br 125<Break> on serial console. 126.It sparc 127<L1>-A, or <Stop>-A on a 128.Tn Sun 129keyboard. 130.br 131<Break> on serial console. 132.It sun3 133<L1>-A, or <Stop>-A on a 134.Tn Sun 135keyboard. 136.br 137<Break> on serial console. 138.It sun3x 139<L1>-A, or <Stop>-A on a 140.Tn Sun 141keyboard. 142.br 143<Break> on serial console. 144.It x68k 145Interrupt switch on the body. 146.El 147.Pp 148In addition, 149.Nm 150may be explicitly activated by the debugging code in the kernel 151if 152.Cm DDB 153is configured. 154.Sh COMMAND SYNTAX 155.Pp 156The general command syntax is: 157.Bd -ragged -offset indent 158.Ic command Ns Op Cm / Ns Ar modifier 159.Ar address 160.Op Cm , Ns Ar count 161.Ed 162.Pp 163The current memory location being edited is referred to as 164.Ar dot , 165and the next location is 166.Ar next . 167They are displayed as hexadecimal numbers. 168.Pp 169Commands that examine and/or modify memory update 170.Ar dot 171to the address of the last line examined or the last location 172modified, and set 173.Ar next 174to the next location to be examined or modified. 175Other commands don't change 176.Ar dot , 177and set 178.Ar next 179to be the same as 180.Ar dot . 181.Pp 182A blank line repeats the previous command from the address 183.Ar next 184with the previous 185.Cm count 186and no modifiers. 187Specifying 188.Cm address 189sets 190.Em dot 191to the address. 192If 193.Cm address 194is omitted, 195.Em dot 196is used. 197A missing 198.Cm count 199is taken to be 1 for printing commands, and infinity for stack traces. 200.Pp 201The syntax: 202.Bd -ragged -offset indent 203.Ic Cm , Ns Ar count 204.Ed 205.Pp 206repeats the previous command, just as a blank line does, but with 207the specified 208.Cm count . 209.Pp 210.Nm 211has a 212.Xr more 1 -like 213functionality; if a number of lines in a command's output exceeds the number 214defined in the 215.Va lines 216variable, then 217.Nm 218displays 219.Dq "--db more--" 220and waits for a response, which may be one of: 221.Bl -tag -offset indent -width "<return>" 222.It <return> 223one more line. 224.It <space> 225one more page. 226.It Ic q 227abort the current command, and return to the command input mode. 228.El 229.Pp 230If 231.Nm 232history editing is enabled (by defining the 233.D1 Cd options DDB_HISTORY_SIZE=num 234kernel option), then a history of the last 235.Cm num 236commands is kept. 237The history can be manipulated with the following key sequences: 238.Bl -tag -offset indent -width "<Ctrl>-P" 239.It <Ctrl>-P 240retrieve previous command in history (if any). 241.It <Ctrl>-N 242retrieve next command in history (if any). 243.El 244.Sh COMMANDS 245.Nm 246supports the following commands: 247.Bl -tag -width 5n 248.It Xo 249.Sm off 250.Ic ! 251.Ar address 252.Oo 253.Cm ( Ar expression 254.Op Ar ,... 255.Cm ) 256.Oc 257.Sm on 258.Xc 259A synonym for 260.Ic call . 261.It Xo 262.Ic break Ns Op Cm /u 263.Ar address Ns Op Cm , Ns Ar count 264.Xc 265Set a breakpoint at 266.Ar address . 267If 268.Ar count 269is supplied, continues 270.Pq Ar count Ns -1 271times before stopping at the breakpoint. 272If the breakpoint is set, a breakpoint number is printed with 273.Sq \&# . 274This number can be used to 275.Ic delete 276the breakpoint, or to add 277conditions to it. 278.Pp 279If 280.Cm /u 281is specified, 282set a breakpoint at a user-space address. 283Without 284.Cm /u , 285.Ar address 286is considered to be in the kernel-space, and an address in the wrong 287space will be rejected, and an error message will be emitted. 288This modifier may only be used if it is supported by machine dependent 289routines. 290.Pp 291Warning: if a user text is shadowed by a normal user-space debugger, 292user-space breakpoints may not work correctly. 293Setting a breakpoint at the low-level code paths may also cause 294strange behavior. 295.It Xo 296.Ic call 297.Sm off 298.Ar address 299.Oo 300.Cm ( Ar expression 301.Op Ar ,... 302.Cm ) 303.Oc 304.Sm on 305.Xc 306Call the function specified by 307.Ar address 308with the argument(s) listed in parentheses. 309Parentheses may be omitted if the function takes no arguments. 310The number of arguments is currently limited to 10. 311.It Ic continue Ns Op Cm /c 312Continue execution until a breakpoint or watchpoint. 313If 314.Cm /c 315is specified, count instructions while executing. 316Some machines (e.g., pmax) also count loads and stores. 317.Pp 318Warning: when counting, the debugger is really silently 319single-stepping. 320This means that single-stepping on low-level may cause strange 321behavior. 322.It Xo 323.Ic delete 324.Ar "address" | 325.Cm # Ns Ar number 326.Xc 327Delete a breakpoint. 328The target breakpoint may be specified by 329.Ar address , 330as per 331.Ic break , 332or by the breakpoint number returned by 333.Ic break 334if it's prefixed with 335.Sq Cm \&# . 336.It Xo 337.Ic dwatch 338.Ar address 339.Xc 340Delete the watchpoint at 341.Ar address 342that was previously set with 343.Ic watch 344command. 345.It Xo 346.Ic examine Ns Op Cm / Ns Ar modifier 347.Ar address Ns Op Cm , Ns Ar count 348.Xc 349Display the address locations according to the format in 350.Ar modifier . 351Multiple modifier formats display multiple locations. 352If 353.Ar modifier 354isn't specified, the modifier from the last use of 355.Ic examine 356is used. 357.Pp 358The valid format characters for 359.Ar modifier 360are: 361.Bl -tag -offset indent -width 2n -compact 362.It Cm b 363examine bytes (8 bits). 364.It Cm h 365examine half-words (16 bits). 366.It Cm l 367examine words (legacy 368.Dq long , 36932 bits). 370.It Cm L 371examine long words (implementation dependent) 372.It Cm a 373print the location being examined. 374.It Cm A 375print the location with a line number if possible. 376.It Cm x 377display in unsigned hex. 378.It Cm z 379display in signed hex. 380.It Cm o 381display in unsigned octal. 382.It Cm d 383display in signed decimal. 384.It Cm u 385display in unsigned decimal. 386.It Cm r 387display in current radix, signed. 388.It Cm c 389display low 8 bits as a character. 390Non-printing characters as displayed as an octal escape code 391(e.g., 392.Sq \e000 ) . 393.It Cm s 394display the NUL terminated string at the location. 395Non-printing characters are displayed as octal escapes. 396.It Cm m 397display in unsigned hex with a character dump at the end of each line. 398The location is displayed as hex at the beginning of each line. 399.It Cm i 400display as a machine instruction. 401.It Cm I 402display as a machine instruction, with possible alternative formats 403depending upon the machine: 404.Bl -tag -offset indent -width "sparc" -compact 405.It alpha 406print register operands 407.It m68k 408use Motorola syntax 409.It pc532 410print instruction bytes in hex 411.It vax 412don't assume that each external label is a procedure entry mask 413.El 414.El 415.It Xo 416.Ic kill 417.Ar pid Ns Op Cm , Ns Ar signal_number 418.Xc 419Send a signal to the process specified by the 420.Ar pid . 421Note that 422.Ar pid 423is interpreted using the current radix (see 424.Cm trace/t 425command for details). 426If 427.Ar signal_number 428isn't specified, the SIGTERM signal is sent. 429.It Ic match Ns Op Cm /p 430A synonym for 431.Ic next . 432.It Ic next Ns Op Cm /p 433Stop at the matching return instruction. 434If 435.Cm /p 436is specified, print the call nesting depth and the 437cumulative instruction count at each call or return. 438Otherwise, only print when the matching return is hit. 439.It Xo 440.Ic print Ns Op Cm /axzodurc 441.Ar address Op Ar address ... 442.Xc 443Print addresses 444.Ar address 445according to the modifier character, as per 446.Ic examine . 447Valid modifiers are: 448.Cm /a , 449.Cm /x , 450.Cm /z , 451.Cm /o , 452.Cm /d , 453.Cm /u , 454.Cm /r , 455and 456.Cm /c 457(as per 458.Ic examine ) . 459If no modifier is specified, the most recent one specified is used. 460.Ar address 461may be a string, and is printed 462.Dq as-is . 463For example: 464.Bd -literal -offset indent 465print/x "eax = " $eax "\enecx = " $ecx "\en" 466.Ed 467.Pp 468will produce: 469.Bd -literal -offset indent 470eax = xxxxxx 471ecx = yyyyyy 472.Ed 473.It Xo 474.Sm off 475.Ic ps 476.Op Cm /a 477.Op Cm /n 478.Op Cm /w 479.Sm on 480.Xc 481A synonym for 482.Ic "show all procs" . 483.It Ic reboot Op Ar flags 484Reboot, using the optionally supplied boot 485.Ar flags . 486.Pp 487Note: Limitations of the command line interface preclude 488specification of a boot string. 489.It Xo 490.Ic search Ns Op Cm /bhl 491.Ar address 492.Ar value 493.Op Ar mask 494.Op Cm , Ns Ar count 495.Xc 496Search memory from 497.Ar address 498for 499.Ar value . 500The unit size is specified with a modifier character, as per 501.Ic examine . 502Valid modifiers are: 503.Cm /b , 504.Cm /h , 505and 506.Cm /l . 507If no modifier is specified, 508.Cm /l 509is used. 510.Pp 511This command might fail in interesting ways if it doesn't find 512.Ar value . 513This is because 514.Nm 515doesn't always recover from touching bad memory. 516The optional 517.Ar count 518limits the search. 519.It Xo 520.Ic set 521.Cm $ Ns Ar variable 522.Op Cm = 523.Ar expression 524.Xc 525Set the named variable or register to the value of 526.Ar expression . 527Valid variable names are described in 528.Sx VARIABLES . 529.It Xo 530.Sm off 531.Ic "show\ all\ procs" 532.Op Cm /a 533.Op Cm /n 534.Op Cm /w 535.Sm on 536.Xc 537Display all process information. 538Valid modifiers: 539.Bl -tag -width 3n 540.It Cm /n 541show process information in a 542.Xr ps 1 543style format (this is the default). 544Information printed includes: process ID, parent process ID, 545process group, UID, process status, process flags, process 546command name, and process wait channel message. 547.It Cm /a 548show the kernel virtual addresses of each process' 549proc structure, u-are, and vmspace structure. 550The vmspace address is also the address of the process' 551vm_map structure, and can be used in the 552.Ic "show map" 553command. 554.It Cm /w 555show each process' PID, command, system call emulation, wait channel 556address, and wait channel message. 557.El 558.It Ic "show breaks" 559Display all breakpoints. 560.It Xo 561.Ic "show buf" Ns Op Cm /f 562.Ar address 563.Xc 564Print the struct buf at 565.Ar address . 566The 567.Cm /f 568does nothing at this time. 569.It Xo 570.Ic "show map" Ns Op Cm /f 571.Ar address 572.Xc 573Print the vm_map at 574.Ar address . 575If 576.Cm /f 577is specified, the complete map is printed. 578.It Ic "show ncache" Ar address 579Dump the namecache list associated with vnode at 580.Ar address . 581.It Xo 582.Ic "show object" Ns Op Cm /f 583.Ar address 584.Xc 585Print the vm_object at 586.Ar address . 587If 588.Cm /f 589is specified, the complete object is printed. 590.It Xo 591.Ic "show page" Ns Op Cm /f 592.Ar address 593.Xc 594Print the vm_page at 595.Ar address . 596If 597.Cm /f 598is specified, the complete page is printed. 599.It Xo 600.Ic "show pool" Ns Op Cm /clp 601.Ar address 602.Xc 603Print the pool at 604.Ar address . 605Valid modifiers: 606.Bl -tag -width 4n -compact 607.It Cm /c 608Print the cachelist and its statistics for this pool. 609.It Cm /l 610Print the log entries for this pool. 611.It Cm /p 612Print the pagelist for this pool. 613.El 614.It Ic "show registers" Ns Op Cm /u 615Display the register set. 616If 617.Cm /u 618is specified, display user registers instead of kernel registers 619or the currently save one. 620.Pp 621Warning: support for 622.Cm /u 623is machine dependent. 624If not supported, incorrect information will be displayed. 625.It Ic "show uvmexp" 626Print a selection of UVM counters and statistics. 627.It Xo 628.Ic "show vnode" Ns Op Cm /f 629.Ar address 630.Xc 631Print the vnode at 632.Ar address . 633If 634.Cm /f 635is specified, the complete vnode is printed. 636.It Ic "show watches" 637Display all watchpoints. 638.It Xo 639.Ic sifting Ns Op Cm /F 640.Ar string 641.Xc 642Search the symbol tables for all symbols of which 643.Ar string 644is a substring, and display them. If 645.Cm /F 646is specified, a character is displayed immediately after each symbol 647name indicating the type of symbol. 648.Pp 649For 650.Ns Xr a.out 5 -format 651symbol tables, 652absolute symbols display 653.Sy @ , 654text segment symbols display 655.Sy * , 656data segment symbols display 657.Sy + , 658.Tn BSS 659segment symbols display 660.Sy - , 661and filename symbols display 662.Sy / . 663For 664.Tn ELF Ns -format 665symbol tables, 666object symbols display 667.Sy + , 668function symbols display 669.Sy * , 670section symbols display 671.Sy & , 672and file symbols display 673.Sy / . 674.Pp 675To sift for a string beginning with a number, escape the first 676character with a backslash as: 677.Bd -literal -offset indent 678sifting \\386 679.Ed 680.It Xo 681.Ic step Ns Op Cm /p 682.Op Cm , Ns Ar count 683.Xc 684Single-step 685.Ar count 686times. 687If 688.Cm /p 689is specified, print each instruction at each step. 690Otherwise, only print the last instruction. 691.Pp 692Warning: depending on the machine type, it may not be possible 693to single-step through some low-level code paths or user-space 694code. 695On machines with software-emulated single-stepping (e.g., pmax), 696stepping through code executed by interrupt handlers will probably 697do the wrong thing. 698.It Ic sync 699Force a crash dump, and then reboot. 700.It Xo 701.Ic trace Ns Op Cm /u 702.Sm off 703.Op Ar frame-address 704.Op Cm , Ar count 705.Sm on 706.Xc 707Stack trace from 708.Ar frame-address . 709If 710.Cm /u 711is specified, trace user-space, otherwise trace kernel-space. 712.Ar count 713is the number of frames to be traced. 714If 715.Ar count 716is omitted, all frames are printed. 717.Pp 718Warning: user-space stack trace is valid only if the machine dependent 719code supports it. 720.It Xo 721.Ic trace/t 722.Sm off 723.Op Ar pid 724.Op Cm , Ar count 725.Sm on 726.Xc 727Stack trace by 728.Dq thread 729(process, on 730.Nx ) 731rather than by stack frame address. 732Note that 733.Ar pid 734is interpreted using the current radix, whilst 735.Ic ps 736displays pids in decimal; prefix 737.Ar pid 738with 739.Sq 0t 740to force it to be interpreted as decimal (see 741.Sx VARIABLES 742section for radix) 743.Pp 744Warning: trace by pid is valid only if the machine dependent code 745supports it. 746.It Ic until Ns Op Cm /p 747Stop at the next call or return instruction. 748If 749.Cm /p 750is specified, print the call nesting depth and the 751cumulative instruction count at each call or return. 752Otherwise, only print when the matching return is hit. 753.It Xo 754.Ic watch 755.Sm off 756.Ar address 757.Op Cm , Ar size 758.Sm on 759.Xc 760Set a watchpoint for a region. 761Execution stops when an attempt to modify the region occurs. 762.Ar size 763defaults to 4. 764.Pp 765If you specify a wrong space address, the request is 766rejected with an error message. 767.Pp 768Warning: attempts to watch wired kernel memory may cause 769an unrecoverable error in some systems such as i386. 770Watchpoints on user addresses work the best. 771.It Xo 772.Ic write Ns Op Cm /bhl 773.Ar address 774.Ar expression Op Ar expression ... 775.Xc 776Write the 777.Ar expression Ns s 778at succeeding locations. 779The unit size is specified with a modifier character, as per 780.Ic examine . 781Valid modifiers are: 782.Cm /b , 783.Cm /h , 784and 785.Cm /l . 786If no modifier is specified, 787.Cm /l 788is used. 789.Pp 790Warning: since there is no delimiter between 791.Ar expression Ns s , 792strange things may occur. 793It's best to enclose each 794.Ar expression 795in parentheses. 796.It Xo 797.Ic x Ns Op Cm / Ns Ar modifier 798.Ar address Ns Op Cm , Ns Ar count 799.Xc 800A synonym for 801.Ic examine . 802.\" XXX - these commands aren't implemented; jhawk 19 May 2000 803.\" .It Ic xf 804.\" Examine forward. 805.\" .Ic xf 806.\" re-executes the most recent 807.\" .Ic execute 808.\" command with the same parameters except that 809.\" .Ar address 810.\" is set to 811.\" .Ar next . 812.\" .It Ic xb 813.\" Examine backward. 814.\" .Ic xb 815.\" re-executes the most recent 816.\" .Ic execute 817.\" command with the same parameters, except that 818.\" .Ar address 819.\" is set to the last start address minus its size. 820.El 821.Sh MACHINE-SPECIFIC COMMANDS 822The "glue" code that hooks 823.Nm 824into the 825.Nx 826kernel for any given port can also add machine specific commands 827to the 828.Nm 829command parser. 830All of these commands are preceded by the command word 831.Em machine 832to indicate that they are part of the machine-specific command 833set (e.g. 834.Ic "machine reboot" ) . 835Some of these commands are: 836.Ss ALPHA 837.Bl -tag -width "intrchain" -compact 838.It Ic halt 839Call the PROM monitor to halt the CPU. 840.It Ic reboot 841Call the PROM monitor to reboot the CPU. 842.El 843.Ss ARM32 844.Bl -tag -width "intrchain" -compact 845.It Ic vmstat 846Equivalent to 847.Xr vmstat 1 848output with "-s" option (statistics). 849.It Ic vnode 850Print out a description of a vnode. 851.It Ic intrchain 852Print the list of IRQ handlers. 853.It Ic panic 854Print the current "panic" string. 855.It Ic frame 856Given a trap frame address, print out the trap frame. 857.El 858.Ss MIPS 859.Bl -tag -width "intrchain" -compact 860.It Ic kvtop 861Print the physical address for a given kernel virtual address. 862.It Ic tlb 863Print out the Translation Lookaside Buffer (TLB). 864Only works in 865.Nx 866kernels compiled with 867.Dv DEBUG 868option. 869.El 870.Ss SPARC 871.Bl -tag -width "intrchain" -compact 872.It Ic prom 873Exit to the Sun PROM monitor. 874.El 875.Ss SPARC64 876.Bl -tag -width "intrchain" -compact 877.It Ic buf 878Print buffer information. 879.It Ic ctx 880Print process context information. 881.It Ic dtlb 882Print data translation look-aside buffer context information. 883.It Ic dtsb 884Display data translation storage buffer information. 885.It Ic kmap 886Display information about the listed mapping in the kernel pmap. Use the 887.Dq f 888modifier to get a full listing. 889.It Ic pcb 890Display information about the 891.Dq struct pcb 892listed. 893.It Ic pctx 894Attempt to change process context. 895.It Ic page 896Display the pointer to the 897.Dq struct vm_page 898for this physical address. 899.It Ic phys 900Display physical memory. 901.It Ic pmap 902Display the pmap. Use the 903.Dq f 904modifier to get a fuller listing. 905.It Ic proc 906Display some information about the process pointed to, or curproc. 907.It Ic prom 908Enter the OFW prom. 909.It Ic pv 910Display the 911.Dq struct pv_entry 912pointed to. 913.It Ic stack 914Dump the window stack. Use the 915.Dq u 916modifier to get userland information. 917.It Ic tf 918Display full trap frame state. This is most useful for inclusion with 919bug reports. 920.It Ic ts 921Display trap state. 922.It Ic traptrace 923Display or set trap trace information. Use the 924.Dq r 925and 926.Dq f 927modifiers to get reversed and full information, respectively. 928.It Ic uvmdump 929Dumps the UVM histories. 930.It Ic watch 931Set or clear a physical or virtual hardware watchpoint. Pass the address 932to be watched, or 933.Dq 0 934to clear the watchpoint. Append 935.Dq p 936to the watch point to use the physical watchpoint registers. 937.It Ic window 938Print register window information about given address. 939.El 940.Ss SUN3 and SUN3X 941.Bl -tag -width "intrchain" -compact 942.It Ic abort 943Drop into monitor via abort (allows continue). 944.It Ic halt 945Exit to Sun PROM monitor as in 946.Xr halt 8 . 947.It Ic reboot 948Reboot the machine as in 949.Xr reboot 8 . 950.It Ic pgmap 951Given an address, print the address, segment map, page map, and 952Page Table Entry (PTE). 953.El 954.Sh VARIABLES 955.Nm 956accesses registers and variables as 957.Cm $ Ns Ar name . 958Register names are as per the 959.Ic "show registers" 960command. 961Some variables are suffixed with numbers, and may have a modifier 962following a colon immediately after the variable name. 963For example, register variables may have a 964.Sq u 965modifier to indicate user register 966(e.g., 967.Li "$eax:u" ) . 968.Pp 969Built-in variables currently supported are: 970.Bl -tag -offset indent -width "maxwidth" -compact 971.It Va lines 972The number of lines. 973This is used by the 974.Ic more 975feature. 976.It Va maxoff 977Addresses are printed as 978.Li 'symbol'+offset 979unless 980.Li offset 981is greater than 982.Va maxoff . 983.It Va maxwidth 984The width of the displayed line. 985.It Va onpanic 986If non-zero (the default), 987.Nm 988will be invoked when the kernel panics. 989If the kernel configuration option 990.D1 Cd options DDB_ONPANIC=0 991is used, 992.Va onpanic 993will be initialized to off. 994.It Va fromconsole 995If non-zero (the default), 996the kernel allows to enter 997.Nm 998from the console (by break signal or special key sequence). 999If the kernel configuration option 1000.D1 Cd options DDB_FROMCONSOLE=0 1001is used, 1002.Va fromconsole 1003will be initialized to off. 1004.It Va radix 1005Input and output radix. 1006.It Va tabstops 1007Tab stop width. 1008.It Va work Ns Sy xx 1009Temporary work variable. 1010.Sq Sy xx 1011is between 0 and 31. 1012.El 1013.Pp 1014All built-in variables are accessible via 1015.Xr sysctl 3 . 1016.Sh EXPRESSIONS 1017Almost all expression operators in C are supported, except 1018.Sq \&~ , 1019.Sq \&^ , 1020and unary 1021.Sq \&& . 1022Special rules in 1023.Nm 1024are: 1025.Bl -tag -offset indent -width "identifier" 1026.It Ar identifier 1027name of a symbol. 1028It is translated to the address (or value) of it. 1029.Sq \&. 1030and 1031.Sq \&: 1032can be used in the identifier. 1033If supported by an object format dependent routine, 1034.Sm off 1035.Xo 1036.Oo Ar filename : Oc 1037.Ar function 1038.Oo : Ar "line number" Oc , 1039.Xc 1040.Xo 1041.Oo Ar filename : Oc 1042.Ar variable , 1043.Xc 1044and 1045.Xo 1046.Ar filename 1047.Oo : Ar "line number" Oc , 1048.Xc 1049.Sm on 1050can be accepted as a symbol. 1051The symbol may be prefixed with 1052.Ar "symbol_table_name" Ns :: 1053(e.g., 1054.Li emulator::mach_msg_trap ) 1055to specify other than kernel symbols. 1056.It Ar number 1057number. 1058Radix is determined by the first two characters: 1059.Sq 0x 1060- hex, 1061.Sq 0o 1062- octal, 1063.Sq 0t 1064- decimal, 1065otherwise follow current radix. 1066.It Cm . 1067.Ar dot 1068.It Cm + 1069.Ar next 1070.It Cm .. 1071address of the start of the last line examined. 1072Unlike 1073.Ar dot 1074or 1075.Ar next , 1076this is only changed by the 1077.Ic examine 1078or 1079.Ic write 1080commands. 1081.It Cm \&" 1082last address explicitly specified. 1083.It Cm $ Ns Ar name 1084register name or variable. 1085It is translated to the value of it. 1086It may be followed by a 1087.Sq \&: 1088and modifiers as described above. 1089.It Cm a 1090multiple of right-hand side. 1091.It Cm * Ns Ar expr 1092expression indirection. 1093It may be followed by a 1094.Sq \&: 1095and modifiers as described above. 1096.El 1097.Sh HISTORY 1098The 1099.Nm 1100kernel debugger was written as part of the MACH project at 1101Carnegie-Mellon University. 1102.Sh SEE ALSO 1103.Xr options 4 , 1104.Xr sysctl 8 1105