1.\" $NetBSD: ddb.4,v 1.48 2000/06/07 13:24:11 jhawk Exp $ 2.\" 3.\" Copyright (c) 1997, 1998 The NetBSD Foundation, Inc. 4.\" All rights reserved. 5.\" 6.\" This code is derived from software contributed to The NetBSD Foundation 7.\" by Luke Mewburn 8.\" 9.\" Redistribution and use in source and binary forms, with or without 10.\" modification, are permitted provided that the following conditions 11.\" are met: 12.\" 1. Redistributions of source code must retain the above copyright 13.\" notice, this list of conditions and the following disclaimer. 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 3. All advertising materials mentioning features or use of this software 18.\" must display the following acknowledgement: 19.\" This product includes software developed by the NetBSD 20.\" Foundation, Inc. and its contributors. 21.\" 4. Neither the name of The NetBSD Foundation nor the names of its 22.\" contributors may be used to endorse or promote products derived 23.\" from this software without specific prior written permission. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 26.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 27.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 28.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 29.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 30.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 31.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 32.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 33.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 34.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 35.\" POSSIBILITY OF SUCH DAMAGE. 36.\" 37.\" --- 38.\" This manual page was derived from a -man.old document which bore 39.\" the following copyright message: 40.\" --- 41.\" 42.\" Mach Operating System 43.\" Copyright (c) 1991,1990 Carnegie Mellon University 44.\" All Rights Reserved. 45.\" 46.\" Permission to use, copy, modify and distribute this software and its 47.\" documentation is hereby granted, provided that both the copyright 48.\" notice and this permission notice appear in all copies of the 49.\" software, derivative works or modified versions, and any portions 50.\" thereof, and that both notices appear in supporting documentation. 51.\" 52.\" CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS" 53.\" CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR 54.\" ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE. 55.\" 56.\" Carnegie Mellon requests users of this software to return to 57.\" 58.\" Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU 59.\" School of Computer Science 60.\" Carnegie Mellon University 61.\" Pittsburgh PA 15213-3890 62.\" 63.\" any improvements or extensions that they make and grant Carnegie Mellon 64.\" the rights to redistribute these changes. 65.\" 66.Dd October 28, 1999 67.Dt DDB 4 68.Os 69.Sh NAME 70.Nm ddb 71.Nd in-kernel debugger 72.Sh SYNOPSIS 73.Cd options DDB 74.Pp 75To enable history editing: 76.Cd options DDB_HISTORY_SIZE=integer 77.Pp 78To disable entering 79.Nm 80upon kernel panic: 81.Cd options DDB_ONPANIC=0 82.Sh DESCRIPTION 83.Nm 84is the in-kernel debugger. 85It may be entered at any time via a special key sequence, and 86optionally may be invoked when the kernel panics. 87.Sh ENTERING THE DEBUGGER 88Unless 89.Dv DDB_ONPANIC 90is set to 0, 91.Nm 92will be activated whenever the kernel would otherwise panic. 93.Pp 94.Nm 95may also be activated from the console. 96In general, sending a break on a serial console will activate 97.Nm "" . 98There are also key sequences for each port that will activate 99.Nm 100from the keyboard: 101.Bl -tag -offset indent -width "mvme68k" -compact 102.It alpha 103<Ctrl>-<Alt>-<Esc> on PC style keyboards. 104.It amiga 105<LAlt>-<LAmiga>-<F10> 106.It atari 107<Alt>-<LeftShift>-<F9> 108.It hp300 109<Shift>-<Reset> 110.It hpcmips 111<Ctrl>-<Alt>-<Esc> 112.It i386 113<Ctrl>-<Alt>-<Esc> 114.br 115<Break> on serial console. 116.It mac68k 117<Command>-<Power>, or the Interrupt switch. 118.It mvme68k 119Abort switch on CPU card. 120.It pmax 121<Do> on 122.Tn LK-201 123rcons console. 124.br 125<Break> on serial console. 126.It sparc 127<L1>-A, or <Stop>-A on a 128.Tn Sun 129keyboard. 130.br 131<Break> on serial console. 132.It sun3 133<L1>-A, or <Stop>-A on a 134.Tn Sun 135keyboard. 136.br 137<Break> on serial console. 138.It sun3x 139<L1>-A, or <Stop>-A on a 140.Tn Sun 141keyboard. 142.br 143<Break> on serial console. 144.It x68k 145Interrupt switch on the body. 146.El 147.Pp 148In addition, 149.Nm 150may be explicitly activated by the debugging code in the kernel 151if 152.Cm DDB 153is configured. 154.Sh COMMAND SYNTAX 155.Pp 156The general command syntax is: 157.Bd -ragged -offset indent 158.Ic command Ns Op Cm / Ns Ar modifier 159.Ar address 160.Op Cm , Ns Ar count 161.Ed 162.Pp 163The current memory location being edited is referred to as 164.Ar dot , 165and the next location is 166.Ar next . 167They are displayed as hexadecimal numbers. 168.Pp 169Commands that examine and/or modify memory update 170.Ar dot 171to the address of the last line examined or the last location 172modified, and set 173.Ar next 174to the next location to be examined or modified. 175Other commands don't change 176.Ar dot , 177and set 178.Ar next 179to be the same as 180.Ar dot . 181.Pp 182A blank line repeats the previous command from the address 183.Ar next 184with the previous 185.Cm count 186and no modifiers. 187Specifying 188.Cm address 189sets 190.Em dot 191to the address. 192If 193.Cm address 194is omitted, 195.Em dot 196is used. 197A missing 198.Cm count 199is taken to be 1 for printing commands, and infinity for stack traces. 200.Pp 201The syntax: 202.Bd -ragged -offset indent 203.Ic Cm , Ns Ar count 204.Ed 205.Pp 206repeats the previous command, just as a blank line does, but with 207the specified 208.Cm count . 209.Pp 210.Nm 211has a 212.Xr more 1 -like 213functionality; if a number of lines in a command's output exceeds the number 214defined in the 215.Va lines 216variable, then 217.Nm 218displays 219.Dq "--db more--" 220and waits for a response, which may be one of: 221.Bl -tag -offset indent -width "<return>" 222.It <return> 223one more line. 224.It <space> 225one more page. 226.It Ic q 227abort the current command, and return to the command input mode. 228.El 229.Pp 230If 231.Nm 232history editing is enabled (by defining the 233.D1 Cd options DDB_HISTORY_SIZE=num 234kernel option), then a history of the last 235.Cm num 236commands is kept. 237The history can be manipulated with the following key sequences: 238.Bl -tag -offset indent -width "<Ctrl>-P" 239.It <Ctrl>-P 240retrieve previous command in history (if any). 241.It <Ctrl>-N 242retrieve next command in history (if any). 243.El 244.Sh COMMANDS 245.Nm 246supports the following commands: 247.Bl -tag -width 5n 248.It Xo 249.Sm off 250.Ic ! 251.Ar address 252.Oo 253.Cm ( Ar expression 254.Op Ar ,... 255.Cm ) 256.Oc 257.Sm on 258.Xc 259A synonym for 260.Ic call . 261.It Xo 262.Ic break Ns Op Cm /u 263.Ar address Ns Op Cm , Ns Ar count 264.Xc 265Set a breakpoint at 266.Ar address . 267If 268.Ar count 269is supplied, continues 270.Pq Ar count Ns -1 271times before stopping at the breakpoint. 272If the breakpoint is set, a breakpoint number is printed with 273.Sq \&# . 274This number can be used to 275.Ic delete 276the breakpoint, or to add 277conditions to it. 278.Pp 279If 280.Cm /u 281is specified, 282set a breakpoint at a user-space address. 283Without 284.Cm /u , 285.Ar address 286is considered to be in the kernel-space, and an address in the wrong 287space will be rejected, and an error message will be emitted. 288This modifier may only be used if it is supported by machine dependent 289routines. 290.Pp 291Warning: if a user text is shadowed by a normal user-space debugger, 292user-space breakpoints may not work correctly. 293Setting a breakpoint at the low-level code paths may also cause 294strange behavior. 295.It Xo 296.Ic call 297.Sm off 298.Ar address 299.Oo 300.Cm ( Ar expression 301.Op Ar ,... 302.Cm ) 303.Oc 304.Sm on 305.Xc 306Call the function specified by 307.Ar address 308with the argument(s) listed in parentheses. 309Parentheses may be omitted if the function takes no arguments. 310The number of arguments is currently limited to 10. 311.It Ic continue Ns Op Cm /c 312Continue execution until a breakpoint or watchpoint. 313If 314.Cm /c 315is specified, count instructions while executing. 316Some machines (e.g., pmax) also count loads and stores. 317.Pp 318Warning: when counting, the debugger is really silently 319single-stepping. 320This means that single-stepping on low-level may cause strange 321behavior. 322.It Xo 323.Ic delete 324.Ar "address" | 325.Cm # Ns Ar number 326.Xc 327Delete a breakpoint. 328The target breakpoint may be specified by 329.Ar address , 330as per 331.Ic break , 332or by the breakpoint number returned by 333.Ic break 334if it's prefixed with 335.Sq Cm \&# . 336.It Xo 337.Ic dwatch 338.Ar address 339.Xc 340Delete the watchpoint at 341.Ar address 342that was previously set with 343.Ic watch 344command. 345.It Xo 346.Ic examine Ns Op Cm / Ns Ar modifier 347.Ar address Ns Op Cm , Ns Ar count 348.Xc 349Display the address locations according to the format in 350.Ar modifier . 351Multiple modifier formats display multiple locations. 352If 353.Ar modifier 354isn't specified, the modifier from the last use of 355.Ic examine 356is used. 357.Pp 358The valid format characters for 359.Ar modifier 360are: 361.Bl -tag -offset indent -width 2n -compact 362.It Cm b 363examine bytes (8 bits). 364.It Cm h 365examine half-words (16 bits). 366.It Cm l 367examine words (legacy 368.Dq long , 36932 bits). 370.It Cm L 371examine long words (implementation dependent) 372.It Cm a 373print the location being examined. 374.It Cm A 375print the location with a line number if possible. 376.It Cm x 377display in unsigned hex. 378.It Cm z 379display in signed hex. 380.It Cm o 381display in unsigned octal. 382.It Cm d 383display in signed decimal. 384.It Cm u 385display in unsigned decimal. 386.It Cm r 387display in current radix, signed. 388.It Cm c 389display low 8 bits as a character. 390Non-printing characters as displayed as an octal escape code 391(e.g., 392.Sq \e000 ) . 393.It Cm s 394display the NUL terminated string at the location. 395Non-printing characters are displayed as octal escapes. 396.It Cm m 397display in unsigned hex with a character dump at the end of each line. 398The location is displayed as hex at the beginning of each line. 399.It Cm i 400display as a machine instruction. 401.It Cm I 402display as a machine instruction, with possible alternative formats 403depending upon the machine: 404.Bl -tag -offset indent -width "sparc" -compact 405.It alpha 406print register operands 407.It m68k 408use Motorola syntax 409.It pc532 410print instruction bytes in hex 411.It vax 412don't assume that each external label is a procedure entry mask 413.El 414.El 415.It Xo 416.Ic kill 417.Ar pid Ns Op Cm , Ns Ar signal_number 418.Xc 419Send a signal to the process specified by the 420.Ar pid . 421Note that 422.Ar pid 423is interpreted using the current radix (see 424.Cm trace/t 425command for details). 426If 427.Ar signal_number 428isn't specified, the SIGTERM signal is sent. 429.It Ic match Ns Op Cm /p 430A synonym for 431.Ic next . 432.It Ic next Ns Op Cm /p 433Stop at the matching return instruction. 434If 435.Cm /p 436is specified, print the call nesting depth and the 437cumulative instruction count at each call or return. 438Otherwise, only print when the matching return is hit. 439.It Xo 440.Ic print Ns Op Cm /axzodurc 441.Ar address Op Ar address ... 442.Xc 443Print addresses 444.Ar address 445according to the modifier character, as per 446.Ic examine . 447Valid modifiers are: 448.Cm /a , 449.Cm /x , 450.Cm /z , 451.Cm /o , 452.Cm /d , 453.Cm /u , 454.Cm /r , 455and 456.Cm /c 457(as per 458.Ic examine ) . 459If no modifier is specified, the most recent one specified is used. 460.Ar address 461may be a string, and is printed 462.Dq as-is . 463For example: 464.Bd -literal -offset indent 465print/x "eax = " $eax "\enecx = " $ecx "\en" 466.Ed 467.Pp 468will produce: 469.Bd -literal -offset indent 470eax = xxxxxx 471ecx = yyyyyy 472.Ed 473.It Xo 474.Sm off 475.Ic ps 476.Op Cm /a 477.Op Cm /n 478.Op Cm /w 479.Sm on 480.Xc 481A synonym for 482.Ic "show all procs" . 483.It Ic reboot Op Ar flags 484Reboot, using the optionally supplied boot 485.Ar flags . 486.Pp 487Note: Limitations of the command line interface preclude 488specification of a boot string. 489.It Xo 490.Ic search Ns Op Cm /bhl 491.Ar address 492.Ar value 493.Op Ar mask 494.Op Cm , Ns Ar count 495.Xc 496Search memory from 497.Ar address 498for 499.Ar value . 500The unit size is specified with a modifier character, as per 501.Ic examine . 502Valid modifiers are: 503.Cm /b , 504.Cm /h , 505and 506.Cm /l . 507If no modifier is specified, 508.Cm /l 509is used. 510.Pp 511This command might fail in interesting ways if it doesn't find 512.Ar value . 513This is because 514.Nm 515doesn't always recover from touching bad memory. 516The optional 517.Ar count 518limits the search. 519.It Xo 520.Ic set 521.Cm $ Ns Ar variable 522.Op Cm = 523.Ar expression 524.Xc 525Set the named variable or register to the value of 526.Ar expression . 527Valid variable names are described in 528.Sx VARIABLES . 529.It Xo 530.Sm off 531.Ic "show\ all\ procs" 532.Op Cm /a 533.Op Cm /n 534.Op Cm /w 535.Sm on 536.Xc 537Display all process information. 538Valid modifiers: 539.Bl -tag -width 3n 540.It Cm /n 541show process information in a 542.Xr ps 1 543style format (this is the default). 544Information printed includes: process ID, parent process ID, 545process group, UID, process status, process flags, process 546command name, and process wait channel message. 547.It Cm /a 548show the kernel virtual addresses of each process' 549proc structure, u-are, and vmspace structure. 550The vmspace address is also the address of the process' 551vm_map structure, and can be used in the 552.Ic "show map" 553command. 554.It Cm /w 555show each process' PID, command, system call emulation, wait channel 556address, and wait channel message. 557.El 558.It Xo 559.Ic "show map" Ns Op Cm /f 560.Ar address 561.Xc 562Print the vm_map at 563.Ar address . 564If 565.Cm /f 566is specified the complete map is printed. 567.It Xo 568.Ic "show object" Ns Op Cm /f 569.Ar address 570.Xc 571Print the vm_object at 572.Ar address . 573If 574.Cm /f 575is specified the complete object is printed. 576.It Ic "show registers" Ns Op Cm /u 577Display the register set. 578If 579.Cm /u 580is specified, display user registers instead of kernel registers 581or the currently save one. 582.Pp 583Warning: support for 584.Cm /u 585is machine dependent. 586If not supported, incorrect information will be displayed. 587.It Ic "show watches" 588Display all watchpoints. 589.It Xo 590.Ic sifting Ns Op Cm /F 591.Ar string 592.Xc 593Search the symbol tables for all symbols of which 594.Ar string 595is a substring, and display them. If 596.Cm /F 597is specified, a character is displayed immediately after each symbol 598name indicating the type of symbol. 599.Pp 600For 601.Ns Xr a.out 5 -format 602symbol tables, 603absolute symbols display 604.Sy @ , 605text segment symbols display 606.Sy * , 607data segment symbols display 608.Sy + , 609.Tn BSS 610segment symbols display 611.Sy - , 612and filename symbols display 613.Sy / . 614For 615.Tn ELF Ns -format 616symbol tables, 617object symbols display 618.Sy + , 619function symbols display 620.Sy * , 621section symbols display 622.Sy & , 623and file symbols display 624.Sy / . 625.Pp 626To sift for a string beginning with a number, escape the first 627character with a backslash as: 628.Bd -literal -offset indent 629sifting \\386 630.Ed 631.It Xo 632.Ic step Ns Op Cm /p 633.Op Cm , Ns Ar count 634.Xc 635Single-step 636.Ar count 637times. 638If 639.Cm /p 640is specified, print each instruction at each step. 641Otherwise, only print the last instruction. 642.Pp 643Warning: depending on the machine type, it may not be possible 644to single-step through some low-level code paths or user-space 645code. 646On machines with software-emulated single-stepping (e.g., pmax), 647stepping through code executed by interrupt handlers will probably 648do the wrong thing. 649.It Ic sync 650Force a crash dump, and then reboot. 651.It Xo 652.Ic trace Ns Op Cm /u 653.Sm off 654.Op Ar frame-address 655.Op Cm , Ar count 656.Sm on 657.Xc 658Stack trace from 659.Ar frame-address . 660If 661.Cm /u 662is specified, trace user-space, otherwise trace kernel-space. 663.Ar count 664is the number of frames to be traced. 665If 666.Ar count 667is omitted, all frames are printed. 668.Pp 669Warning: user-space stack trace is valid only if the machine dependent 670code supports it. 671.It Xo 672.Ic trace/t 673.Sm off 674.Op Ar pid 675.Op Cm , Ar count 676.Sm on 677.Xc 678Stack trace by 679.Dq thread 680(process, on 681.Nx ) 682rather than by stack frame address. 683Note that 684.Ar pid 685is interpreted using the current radix, whilst 686.Ic ps 687displays pids in decimal; prefix 688.Ar pid 689with 690.Sq 0t 691to force it to be interpreted as decimal (see 692.Sx VARIABLES 693section for radix) 694.Pp 695Warning: trace by pid is valid only if the machine dependent code 696supports it. 697.It Ic until Ns Op Cm /p 698Stop at the next call or return instruction. 699If 700.Cm /p 701is specified, print the call nesting depth and the 702cumulative instruction count at each call or return. 703Otherwise, only print when the matching return is hit. 704.It Xo 705.Ic watch 706.Sm off 707.Ar address 708.Op Cm , Ar size 709.Sm on 710.Xc 711Set a watchpoint for a region. 712Execution stops when an attempt to modify the region occurs. 713.Ar size 714defaults to 4. 715.Pp 716If you specify a wrong space address, the request is 717rejected with an error message. 718.Pp 719Warning: attempts to watch wired kernel memory may cause 720an unrecoverable error in some systems such as i386. 721Watchpoints on user addresses work the best. 722.It Xo 723.Ic write Ns Op Cm /bhl 724.Ar address 725.Ar expression Op Ar expression ... 726.Xc 727Write the 728.Ar expression Ns s 729at succeeding locations. 730The unit size is specified with a modifier character, as per 731.Ic examine . 732Valid modifiers are: 733.Cm /b , 734.Cm /h , 735and 736.Cm /l . 737If no modifier is specified, 738.Cm /l 739is used. 740.Pp 741Warning: since there is no delimiter between 742.Ar expression Ns s , 743strange things may occur. 744It's best to enclose each 745.Ar expression 746in parentheses. 747.It Xo 748.Ic x Ns Op Cm / Ns Ar modifier 749.Ar address Ns Op Cm , Ns Ar count 750.Xc 751A synonym for 752.Ic examine . 753.\" XXX - these commands aren't implemented; jhawk 19 May 2000 754.\" .It Ic xf 755.\" Examine forward. 756.\" .Ic xf 757.\" re-executes the most recent 758.\" .Ic execute 759.\" command with the same parameters except that 760.\" .Ar address 761.\" is set to 762.\" .Ar next . 763.\" .It Ic xb 764.\" Examine backward. 765.\" .Ic xb 766.\" re-executes the most recent 767.\" .Ic execute 768.\" command with the same parameters, except that 769.\" .Ar address 770.\" is set to the last start address minus its size. 771.El 772.Sh MACHINE-SPECIFIC COMMANDS 773The "glue" code that hooks 774.Nm 775into the 776.Nx 777kernel for any given port can also add machine specific commands 778to the 779.Nm 780command parser. 781All of these commands are preceded by the command word 782.Em machine 783to indicate that they are part of the machine-specific command 784set (e.g. 785.Ic "machine reboot" ) . 786Some of these commands are: 787.Ss ALPHA 788.Bl -tag -width "intrchain" -compact 789.It Ic halt 790Call the PROM monitor to halt the CPU. 791.It Ic reboot 792Call the PROM monitor to reboot the CPU. 793.El 794.Ss ARM32 795.Bl -tag -width "intrchain" -compact 796.It Ic vmstat 797Equivalent to 798.Xr vmstat 8 799output with "-s" option (statistics). 800.It Ic vnode 801Print out a description of a vnode. 802.It Ic intrchain 803Print the list of IRQ handlers. 804.It Ic panic 805Print the current "panic" string. 806.It Ic frame 807Given a trap frame address, print out the trap frame. 808.El 809.Ss MIPS 810.Bl -tag -width "intrchain" -compact 811.It Ic kvtop 812Print the physical address for a given kernel virtual address. 813.It Ic tlb 814Print out the Translation Lookaside Buffer (TLB). 815Only works in 816.Nx 817kernels compiled with 818.Dv DEBUG 819option. 820.El 821.Ss SPARC 822.Bl -tag -width "intrchain" -compact 823.It Ic prom 824Exit to the Sun PROM monitor. 825.El 826.Ss SUN3 and SUN3X 827.Bl -tag -width "intrchain" -compact 828.It Ic abort 829Drop into monitor via abort (allows continue). 830.It Ic halt 831Exit to Sun PROM monitor as in 832.Xr halt 8 . 833.It Ic reboot 834Reboot the machine as in 835.Xr reboot 8 . 836.It Ic pgmap 837Given an address, print the address, segment map, page map, and 838Page Table Entry (PTE). 839.El 840.Sh VARIABLES 841.Nm 842accesses registers and variables as 843.Cm $ Ns Ar name . 844Register names are as per the 845.Ic "show registers" 846command. 847Some variables are suffixed with numbers, and may have a modifier 848following a colon immediately after the variable name. 849For example, register variables may have a 850.Sq u 851modifier to indicate user register 852(e.g., 853.Li "$eax:u" ) . 854.Pp 855Built-in variables currently supported are: 856.Bl -tag -offset indent -width "maxwidth" -compact 857.It Va lines 858The number of lines. 859This is used by the 860.Ic more 861feature. 862.It Va maxoff 863Addresses are printed as 864.Li 'symbol'+offset 865unless 866.Li offset 867is greater than 868.Va maxoff . 869.It Va maxwidth 870The width of the displayed line. 871.It Va onpanic 872If non-zero (the default), 873.Nm 874will be invoked when the kernel panics. 875If the kernel configuration option 876.D1 Cd options DDB_ONPANIC=0 877is used, 878.Va onpanic 879will be initialised to off. 880.It Va radix 881Input and output radix. 882.It Va tabstops 883Tab stop width. 884.It Va work Ns Sy xx 885Temporary work variable. 886.Sq Sy xx 887is between 0 and 31. 888.El 889.Pp 890All built-in variables are accessible via 891.Xr sysctl 3 . 892.Sh EXPRESSIONS 893Almost all expression operators in C are supported, except 894.Sq \&~ , 895.Sq \&^ , 896and unary 897.Sq \&& . 898Special rules in 899.Nm 900are: 901.Bl -tag -offset indent -width "identifier" 902.It Ar identifier 903name of a symbol. 904It is translated to the address (or value) of it. 905.Sq \&. 906and 907.Sq \&: 908can be used in the identifier. 909If supported by an object format dependent routine, 910.Sm off 911.Xo 912.Oo Ar filename : Oc 913.Ar function 914.Oo : Ar "line number" Oc , 915.Xc 916.Xo 917.Oo Ar filename : Oc 918.Ar variable , 919.Xc 920and 921.Xo 922.Ar filename 923.Oo : Ar "line number" Oc , 924.Xc 925.Sm on 926can be accepted as a symbol. 927The symbol may be prefixed with 928.Ar "symbol_table_name" Ns :: 929(e.g., 930.Li emulator::mach_msg_trap ) 931to specify other than kernel symbols. 932.It Ar number 933number. 934Radix is determined by the first two characters: 935.Sq 0x 936- hex, 937.Sq 0o 938- octal, 939.Sq 0t 940- decimal, 941otherwise follow current radix. 942.It Cm . 943.Ar dot 944.It Cm + 945.Ar next 946.It Cm .. 947address of the start of the last line examined. 948Unlike 949.Ar dot 950or 951.Ar next , 952this is only changed by the 953.Ic examine 954or 955.Ic write 956commands. 957.It Cm \&" 958last address explicitly specified. 959.It Cm $ Ns Ar name 960register name or variable. 961It is translated to the value of it. 962It may be followed by a 963.Sq \&: 964and modifiers as described above. 965.It Cm a 966multiple of right-hand side. 967.It Cm * Ns Ar expr 968expression indirection. 969It may be followed by a 970.Sq \&: 971and modifiers as described above. 972.El 973.Sh HISTORY 974The 975.Nm 976kernel debugger was written as part of the MACH project at 977Carnegie-Mellon University. 978.Sh SEE ALSO 979.Xr options 4 , 980.Xr sysctl 8 981