1.\" $NetBSD: ddb.4,v 1.58 2002/05/09 16:42:16 uch Exp $ 2.\" 3.\" Copyright (c) 1997 - 2001 The NetBSD Foundation, Inc. 4.\" All rights reserved. 5.\" 6.\" This code is derived from software contributed to The NetBSD Foundation 7.\" by Luke Mewburn 8.\" 9.\" Redistribution and use in source and binary forms, with or without 10.\" modification, are permitted provided that the following conditions 11.\" are met: 12.\" 1. Redistributions of source code must retain the above copyright 13.\" notice, this list of conditions and the following disclaimer. 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 3. All advertising materials mentioning features or use of this software 18.\" must display the following acknowledgement: 19.\" This product includes software developed by the NetBSD 20.\" Foundation, Inc. and its contributors. 21.\" 4. Neither the name of The NetBSD Foundation nor the names of its 22.\" contributors may be used to endorse or promote products derived 23.\" from this software without specific prior written permission. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 26.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 27.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 28.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 29.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 30.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 31.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 32.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 33.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 34.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 35.\" POSSIBILITY OF SUCH DAMAGE. 36.\" 37.\" --- 38.\" This manual page was derived from a -man.old document which bore 39.\" the following copyright message: 40.\" --- 41.\" 42.\" Mach Operating System 43.\" Copyright (c) 1991,1990 Carnegie Mellon University 44.\" All Rights Reserved. 45.\" 46.\" Permission to use, copy, modify and distribute this software and its 47.\" documentation is hereby granted, provided that both the copyright 48.\" notice and this permission notice appear in all copies of the 49.\" software, derivative works or modified versions, and any portions 50.\" thereof, and that both notices appear in supporting documentation. 51.\" 52.\" CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS" 53.\" CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR 54.\" ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE. 55.\" 56.\" Carnegie Mellon requests users of this software to return to 57.\" 58.\" Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU 59.\" School of Computer Science 60.\" Carnegie Mellon University 61.\" Pittsburgh PA 15213-3890 62.\" 63.\" any improvements or extensions that they make and grant Carnegie Mellon 64.\" the rights to redistribute these changes. 65.\" 66.Dd February 11, 2001 67.Dt DDB 4 68.Os 69.Sh NAME 70.Nm ddb 71.Nd in-kernel debugger 72.Sh SYNOPSIS 73.Cd options DDB 74.Pp 75To enable history editing: 76.Cd options DDB_HISTORY_SIZE=integer 77.Pp 78To disable entering 79.Nm 80upon kernel panic: 81.Cd options DDB_ONPANIC=0 82.Sh DESCRIPTION 83.Nm 84is the in-kernel debugger. 85It may be entered at any time via a special key sequence, and 86optionally may be invoked when the kernel panics. 87.Sh ENTERING THE DEBUGGER 88Unless 89.Dv DDB_ONPANIC 90is set to 0, 91.Nm 92will be activated whenever the kernel would otherwise panic. 93.Pp 94.Nm 95may also be activated from the console. 96In general, sending a break on a serial console will activate 97.Nm "" . 98There are also key sequences for each port that will activate 99.Nm 100from the keyboard: 101.Bl -tag -offset indent -width "mvme68k" -compact 102.It alpha 103\*[Lt]Ctrl\*[Gt]-\*[Lt]Alt\*[Gt]-\*[Lt]Esc\*[Gt] on PC style keyboards. 104.It amiga 105\*[Lt]LAlt\*[Gt]-\*[Lt]LAmiga\*[Gt]-\*[Lt]F10\*[Gt] 106.It atari 107\*[Lt]Alt\*[Gt]-\*[Lt]LeftShift\*[Gt]-\*[Lt]F9\*[Gt] 108.It hp300 109\*[Lt]Shift\*[Gt]-\*[Lt]Reset\*[Gt] 110.It hpcmips 111\*[Lt]Ctrl\*[Gt]-\*[Lt]Alt\*[Gt]-\*[Lt]Esc\*[Gt] 112.It hpcsh 113\*[Lt]Ctrl\*[Gt]-\*[Lt]Alt\*[Gt]-\*[Lt]Esc\*[Gt] 114.It i386 115\*[Lt]Ctrl\*[Gt]-\*[Lt]Alt\*[Gt]-\*[Lt]Esc\*[Gt] 116.br 117\*[Lt]Break\*[Gt] on serial console. 118.It mac68k 119\*[Lt]Command\*[Gt]-\*[Lt]Power\*[Gt], or the Interrupt switch. 120.It mvme68k 121Abort switch on CPU card. 122.It pmax 123\*[Lt]Do\*[Gt] on 124.Tn LK-201 125rcons console. 126.br 127\*[Lt]Break\*[Gt] on serial console. 128.It sparc 129\*[Lt]L1\*[Gt]-A, or \*[Lt]Stop\*[Gt]-A on a 130.Tn Sun 131keyboard. 132.br 133\*[Lt]Break\*[Gt] on serial console. 134.It sun3 135\*[Lt]L1\*[Gt]-A, or \*[Lt]Stop\*[Gt]-A on a 136.Tn Sun 137keyboard. 138.br 139\*[Lt]Break\*[Gt] on serial console. 140.It sun3x 141\*[Lt]L1\*[Gt]-A, or \*[Lt]Stop\*[Gt]-A on a 142.Tn Sun 143keyboard. 144.br 145\*[Lt]Break\*[Gt] on serial console. 146.It x68k 147Interrupt switch on the body. 148.El 149.Pp 150In addition, 151.Nm 152may be explicitly activated by the debugging code in the kernel 153if 154.Cm DDB 155is configured. 156.Sh COMMAND SYNTAX 157The general command syntax is: 158.Bd -ragged -offset indent 159.Ic command Ns Op Cm / Ns Ar modifier 160.Ar address 161.Op Cm , Ns Ar count 162.Ed 163.Pp 164The current memory location being edited is referred to as 165.Ar dot , 166and the next location is 167.Ar next . 168They are displayed as hexadecimal numbers. 169.Pp 170Commands that examine and/or modify memory update 171.Ar dot 172to the address of the last line examined or the last location 173modified, and set 174.Ar next 175to the next location to be examined or modified. 176Other commands don't change 177.Ar dot , 178and set 179.Ar next 180to be the same as 181.Ar dot . 182.Pp 183A blank line repeats the previous command from the address 184.Ar next 185with the previous 186.Cm count 187and no modifiers. 188Specifying 189.Cm address 190sets 191.Em dot 192to the address. 193If 194.Cm address 195is omitted, 196.Em dot 197is used. 198A missing 199.Cm count 200is taken to be 1 for printing commands, and infinity for stack traces. 201.Pp 202The syntax: 203.Bd -ragged -offset indent 204.Ic Cm , Ns Ar count 205.Ed 206.Pp 207repeats the previous command, just as a blank line does, but with 208the specified 209.Cm count . 210.Pp 211.Nm 212has a 213.Xr more 1 -like 214functionality; if a number of lines in a command's output exceeds the number 215defined in the 216.Va lines 217variable, then 218.Nm 219displays 220.Dq "--db more--" 221and waits for a response, which may be one of: 222.Bl -tag -offset indent -width "\*[Lt]return\*[Gt]" 223.It \*[Lt]return\*[Gt] 224one more line. 225.It \*[Lt]space\*[Gt] 226one more page. 227.It Ic q 228abort the current command, and return to the command input mode. 229.El 230.Pp 231If 232.Nm 233history editing is enabled (by defining the 234.D1 Cd options DDB_HISTORY_SIZE=num 235kernel option), then a history of the last 236.Cm num 237commands is kept. 238The history can be manipulated with the following key sequences: 239.Bl -tag -offset indent -width "\*[Lt]Ctrl\*[Gt]-P" 240.It \*[Lt]Ctrl\*[Gt]-P 241retrieve previous command in history (if any). 242.It \*[Lt]Ctrl\*[Gt]-N 243retrieve next command in history (if any). 244.El 245.Sh COMMANDS 246.Nm 247supports the following commands: 248.Bl -tag -width 5n 249.It Xo 250.Sm off 251.Ic ! 252.Ar address 253.Oo 254.Cm ( Ar expression 255.Op Ar ,... 256.Cm ) 257.Oc 258.Sm on 259.Xc 260A synonym for 261.Ic call . 262.It Xo 263.Ic break Ns Op Cm /u 264.Ar address Ns Op Cm , Ns Ar count 265.Xc 266Set a breakpoint at 267.Ar address . 268If 269.Ar count 270is supplied, continues 271.Pq Ar count Ns -1 272times before stopping at the breakpoint. 273If the breakpoint is set, a breakpoint number is printed with 274.Sq \&# . 275This number can be used to 276.Ic delete 277the breakpoint, or to add 278conditions to it. 279.Pp 280If 281.Cm /u 282is specified, 283set a breakpoint at a user-space address. 284Without 285.Cm /u , 286.Ar address 287is considered to be in the kernel-space, and an address in the wrong 288space will be rejected, and an error message will be emitted. 289This modifier may only be used if it is supported by machine dependent 290routines. 291.Pp 292Warning: if a user text is shadowed by a normal user-space debugger, 293user-space breakpoints may not work correctly. 294Setting a breakpoint at the low-level code paths may also cause 295strange behavior. 296.It Xo 297.Ic call 298.Sm off 299.Ar address 300.Oo 301.Cm ( Ar expression 302.Op Ar ,... 303.Cm ) 304.Oc 305.Sm on 306.Xc 307Call the function specified by 308.Ar address 309with the argument(s) listed in parentheses. 310Parentheses may be omitted if the function takes no arguments. 311The number of arguments is currently limited to 10. 312.It Ic continue Ns Op Cm /c 313Continue execution until a breakpoint or watchpoint. 314If 315.Cm /c 316is specified, count instructions while executing. 317Some machines (e.g., pmax) also count loads and stores. 318.Pp 319Warning: when counting, the debugger is really silently 320single-stepping. 321This means that single-stepping on low-level may cause strange 322behavior. 323.It Xo 324.Ic delete 325.Ar "address" | 326.Cm # Ns Ar number 327.Xc 328Delete a breakpoint. 329The target breakpoint may be specified by 330.Ar address , 331as per 332.Ic break , 333or by the breakpoint number returned by 334.Ic break 335if it's prefixed with 336.Sq Cm \&# . 337.It Xo 338.Ic dwatch 339.Ar address 340.Xc 341Delete the watchpoint at 342.Ar address 343that was previously set with 344.Ic watch 345command. 346.It Xo 347.Ic examine Ns Op Cm / Ns Ar modifier 348.Ar address Ns Op Cm , Ns Ar count 349.Xc 350Display the address locations according to the format in 351.Ar modifier . 352Multiple modifier formats display multiple locations. 353If 354.Ar modifier 355isn't specified, the modifier from the last use of 356.Ic examine 357is used. 358.Pp 359The valid format characters for 360.Ar modifier 361are: 362.Bl -tag -offset indent -width 2n -compact 363.It Cm b 364examine bytes (8 bits). 365.It Cm h 366examine half-words (16 bits). 367.It Cm l 368examine words (legacy 369.Dq long , 37032 bits). 371.It Cm L 372examine long words (implementation dependent) 373.It Cm a 374print the location being examined. 375.It Cm A 376print the location with a line number if possible. 377.It Cm x 378display in unsigned hex. 379.It Cm z 380display in signed hex. 381.It Cm o 382display in unsigned octal. 383.It Cm d 384display in signed decimal. 385.It Cm u 386display in unsigned decimal. 387.It Cm r 388display in current radix, signed. 389.It Cm c 390display low 8 bits as a character. 391Non-printing characters as displayed as an octal escape code 392(e.g., 393.Sq \e000 ) . 394.It Cm s 395display the NUL terminated string at the location. 396Non-printing characters are displayed as octal escapes. 397.It Cm m 398display in unsigned hex with a character dump at the end of each line. 399The location is displayed as hex at the beginning of each line. 400.It Cm i 401display as a machine instruction. 402.It Cm I 403display as a machine instruction, with possible alternative formats 404depending upon the machine: 405.Bl -tag -offset indent -width "sparc" -compact 406.It alpha 407print register operands 408.It m68k 409use Motorola syntax 410.It pc532 411print instruction bytes in hex 412.It vax 413don't assume that each external label is a procedure entry mask 414.El 415.El 416.It Xo 417.Ic kill 418.Ar pid Ns Op Cm , Ns Ar signal_number 419.Xc 420Send a signal to the process specified by the 421.Ar pid . 422Note that 423.Ar pid 424is interpreted using the current radix (see 425.Cm trace/t 426command for details). 427If 428.Ar signal_number 429isn't specified, the SIGTERM signal is sent. 430.It Ic match Ns Op Cm /p 431A synonym for 432.Ic next . 433.It Ic next Ns Op Cm /p 434Stop at the matching return instruction. 435If 436.Cm /p 437is specified, print the call nesting depth and the 438cumulative instruction count at each call or return. 439Otherwise, only print when the matching return is hit. 440.It Xo 441.Ic print Ns Op Cm /axzodurc 442.Ar address Op Ar address ... 443.Xc 444Print addresses 445.Ar address 446according to the modifier character, as per 447.Ic examine . 448Valid modifiers are: 449.Cm /a , 450.Cm /x , 451.Cm /z , 452.Cm /o , 453.Cm /d , 454.Cm /u , 455.Cm /r , 456and 457.Cm /c 458(as per 459.Ic examine ) . 460If no modifier is specified, the most recent one specified is used. 461.Ar address 462may be a string, and is printed 463.Dq as-is . 464For example: 465.Bd -literal -offset indent 466print/x "eax = " $eax "\enecx = " $ecx "\en" 467.Ed 468.Pp 469will produce: 470.Bd -literal -offset indent 471eax = xxxxxx 472ecx = yyyyyy 473.Ed 474.It Xo 475.Sm off 476.Ic ps 477.Op Cm /a 478.Op Cm /n 479.Op Cm /w 480.Sm on 481.Xc 482A synonym for 483.Ic "show all procs" . 484.It Ic reboot Op Ar flags 485Reboot, using the optionally supplied boot 486.Ar flags . 487.Pp 488Note: Limitations of the command line interface preclude 489specification of a boot string. 490.It Xo 491.Ic search Ns Op Cm /bhl 492.Ar address 493.Ar value 494.Op Ar mask 495.Op Cm , Ns Ar count 496.Xc 497Search memory from 498.Ar address 499for 500.Ar value . 501The unit size is specified with a modifier character, as per 502.Ic examine . 503Valid modifiers are: 504.Cm /b , 505.Cm /h , 506and 507.Cm /l . 508If no modifier is specified, 509.Cm /l 510is used. 511.Pp 512This command might fail in interesting ways if it doesn't find 513.Ar value . 514This is because 515.Nm 516doesn't always recover from touching bad memory. 517The optional 518.Ar count 519limits the search. 520.It Xo 521.Ic set 522.Cm $ Ns Ar variable 523.Op Cm = 524.Ar expression 525.Xc 526Set the named variable or register to the value of 527.Ar expression . 528Valid variable names are described in 529.Sx VARIABLES . 530.It Xo 531.Sm off 532.Ic "show\ all\ procs" 533.Op Cm /a 534.Op Cm /n 535.Op Cm /w 536.Sm on 537.Xc 538Display all process information. 539Valid modifiers: 540.Bl -tag -width 3n 541.It Cm /n 542show process information in a 543.Xr ps 1 544style format (this is the default). 545Information printed includes: process ID, parent process ID, 546process group, UID, process status, process flags, process 547command name, and process wait channel message. 548.It Cm /a 549show the kernel virtual addresses of each process' 550proc structure, u-area, and vmspace structure. 551The vmspace address is also the address of the process' 552vm_map structure, and can be used in the 553.Ic "show map" 554command. 555.It Cm /w 556show each process' PID, command, system call emulation, wait channel 557address, and wait channel message. 558.El 559.It Ic "show breaks" 560Display all breakpoints. 561.It Xo 562.Ic "show buf" Ns Op Cm /f 563.Ar address 564.Xc 565Print the struct buf at 566.Ar address . 567The 568.Cm /f 569does nothing at this time. 570.It Xo 571.Ic "show event" Ns Op Cm /f 572.Xc 573Print all the non-zero 574.Xr evcnt 9 575event counters. 576If 577.Cm /f 578is specified, all event counters with a count of zero are printed as well. 579.It Xo 580.Ic "show map" Ns Op Cm /f 581.Ar address 582.Xc 583Print the vm_map at 584.Ar address . 585If 586.Cm /f 587is specified, the complete map is printed. 588.It Ic "show ncache" Ar address 589Dump the namecache list associated with vnode at 590.Ar address . 591.It Xo 592.Ic "show object" Ns Op Cm /f 593.Ar address 594.Xc 595Print the vm_object at 596.Ar address . 597If 598.Cm /f 599is specified, the complete object is printed. 600.It Xo 601.Ic "show page" Ns Op Cm /f 602.Ar address 603.Xc 604Print the vm_page at 605.Ar address . 606If 607.Cm /f 608is specified, the complete page is printed. 609.It Xo 610.Ic "show pool" Ns Op Cm /clp 611.Ar address 612.Xc 613Print the pool at 614.Ar address . 615Valid modifiers: 616.Bl -tag -width 4n -compact 617.It Cm /c 618Print the cachelist and its statistics for this pool. 619.It Cm /l 620Print the log entries for this pool. 621.It Cm /p 622Print the pagelist for this pool. 623.El 624.It Ic "show registers" Ns Op Cm /u 625Display the register set. 626If 627.Cm /u 628is specified, display user registers instead of kernel registers 629or the currently save one. 630.Pp 631Warning: support for 632.Cm /u 633is machine dependent. 634If not supported, incorrect information will be displayed. 635.It Ic "show uvmexp" 636Print a selection of UVM counters and statistics. 637.It Xo 638.Ic "show vnode" Ns Op Cm /f 639.Ar address 640.Xc 641Print the vnode at 642.Ar address . 643If 644.Cm /f 645is specified, the complete vnode is printed. 646.It Ic "show watches" 647Display all watchpoints. 648.It Xo 649.Ic sifting Ns Op Cm /F 650.Ar string 651.Xc 652Search the symbol tables for all symbols of which 653.Ar string 654is a substring, and display them. If 655.Cm /F 656is specified, a character is displayed immediately after each symbol 657name indicating the type of symbol. 658.Pp 659For 660.Ns Xr a.out 5 -format 661symbol tables, 662absolute symbols display 663.Sy @ , 664text segment symbols display 665.Sy * , 666data segment symbols display 667.Sy + , 668.Tn BSS 669segment symbols display 670.Sy - , 671and filename symbols display 672.Sy / . 673For 674.Tn ELF Ns -format 675symbol tables, 676object symbols display 677.Sy + , 678function symbols display 679.Sy * , 680section symbols display 681.Sy \*[Am] , 682and file symbols display 683.Sy / . 684.Pp 685To sift for a string beginning with a number, escape the first 686character with a backslash as: 687.Bd -literal -offset indent 688sifting \\386 689.Ed 690.It Xo 691.Ic step Ns Op Cm /p 692.Op Cm , Ns Ar count 693.Xc 694Single-step 695.Ar count 696times. 697If 698.Cm /p 699is specified, print each instruction at each step. 700Otherwise, only print the last instruction. 701.Pp 702Warning: depending on the machine type, it may not be possible 703to single-step through some low-level code paths or user-space 704code. 705On machines with software-emulated single-stepping (e.g., pmax), 706stepping through code executed by interrupt handlers will probably 707do the wrong thing. 708.It Ic sync 709Force a crash dump, and then reboot. 710.It Xo 711.Ic trace Ns Op Cm /u 712.Sm off 713.Op Ar frame-address 714.Op Cm , Ar count 715.Sm on 716.Xc 717Stack trace from 718.Ar frame-address . 719If 720.Cm /u 721is specified, trace user-space, otherwise trace kernel-space. 722.Ar count 723is the number of frames to be traced. 724If 725.Ar count 726is omitted, all frames are printed. 727.Pp 728Warning: user-space stack trace is valid only if the machine dependent 729code supports it. 730.It Xo 731.Ic trace/t 732.Sm off 733.Op Ar pid 734.Op Cm , Ar count 735.Sm on 736.Xc 737Stack trace by 738.Dq thread 739(process, on 740.Nx ) 741rather than by stack frame address. 742Note that 743.Ar pid 744is interpreted using the current radix, whilst 745.Ic ps 746displays pids in decimal; prefix 747.Ar pid 748with 749.Sq 0t 750to force it to be interpreted as decimal (see 751.Sx VARIABLES 752section for radix) 753.Pp 754Warning: trace by pid is valid only if the machine dependent code 755supports it. 756.It Ic until Ns Op Cm /p 757Stop at the next call or return instruction. 758If 759.Cm /p 760is specified, print the call nesting depth and the 761cumulative instruction count at each call or return. 762Otherwise, only print when the matching return is hit. 763.It Xo 764.Ic watch 765.Sm off 766.Ar address 767.Op Cm , Ar size 768.Sm on 769.Xc 770Set a watchpoint for a region. 771Execution stops when an attempt to modify the region occurs. 772.Ar size 773defaults to 4. 774.Pp 775If you specify a wrong space address, the request is 776rejected with an error message. 777.Pp 778Warning: attempts to watch wired kernel memory may cause 779an unrecoverable error in some systems such as i386. 780Watchpoints on user addresses work the best. 781.It Xo 782.Ic write Ns Op Cm /bhl 783.Ar address 784.Ar expression Op Ar expression ... 785.Xc 786Write the 787.Ar expression Ns s 788at succeeding locations. 789The unit size is specified with a modifier character, as per 790.Ic examine . 791Valid modifiers are: 792.Cm /b , 793.Cm /h , 794and 795.Cm /l . 796If no modifier is specified, 797.Cm /l 798is used. 799.Pp 800Warning: since there is no delimiter between 801.Ar expression Ns s , 802strange things may occur. 803It's best to enclose each 804.Ar expression 805in parentheses. 806.It Xo 807.Ic x Ns Op Cm / Ns Ar modifier 808.Ar address Ns Op Cm , Ns Ar count 809.Xc 810A synonym for 811.Ic examine . 812.\" XXX - these commands aren't implemented; jhawk 19 May 2000 813.\" .It Ic xf 814.\" Examine forward. 815.\" .Ic xf 816.\" re-executes the most recent 817.\" .Ic execute 818.\" command with the same parameters except that 819.\" .Ar address 820.\" is set to 821.\" .Ar next . 822.\" .It Ic xb 823.\" Examine backward. 824.\" .Ic xb 825.\" re-executes the most recent 826.\" .Ic execute 827.\" command with the same parameters, except that 828.\" .Ar address 829.\" is set to the last start address minus its size. 830.El 831.Sh MACHINE-SPECIFIC COMMANDS 832The "glue" code that hooks 833.Nm 834into the 835.Nx 836kernel for any given port can also add machine specific commands 837to the 838.Nm 839command parser. 840All of these commands are preceded by the command word 841.Em machine 842to indicate that they are part of the machine-specific command 843set (e.g. 844.Ic "machine reboot" ) . 845Some of these commands are: 846.Ss ALPHA 847.Bl -tag -width "intrchain" -compact 848.It Ic halt 849Call the PROM monitor to halt the CPU. 850.It Ic reboot 851Call the PROM monitor to reboot the CPU. 852.El 853.Ss ARM32 854.Bl -tag -width "intrchain" -compact 855.It Ic vmstat 856Equivalent to 857.Xr vmstat 1 858output with "-s" option (statistics). 859.It Ic vnode 860Print out a description of a vnode. 861.It Ic intrchain 862Print the list of IRQ handlers. 863.It Ic panic 864Print the current "panic" string. 865.It Ic frame 866Given a trap frame address, print out the trap frame. 867.El 868.Ss MIPS 869.Bl -tag -width "intrchain" -compact 870.It Ic kvtop 871Print the physical address for a given kernel virtual address. 872.It Ic tlb 873Print out the Translation Lookaside Buffer (TLB). 874Only works in 875.Nx 876kernels compiled with 877.Dv DEBUG 878option. 879.El 880.Ss SH3 881.Bl -tag -width "intrchain" -compact 882.It Ic tlb 883Print TLB entries 884.It Ic cache 885Print cache entries 886.It Ic frame 887Print switch frame and trap frames. 888.It Ic stack 889Print kernel stack usage. Only works in NetBSD kernels compiled with 890KSTACK_DEBUG option. 891.El 892.Ss SPARC 893.Bl -tag -width "intrchain" -compact 894.It Ic prom 895Exit to the Sun PROM monitor. 896.El 897.Ss SPARC64 898.Bl -tag -width "intrchain" -compact 899.It Ic buf 900Print buffer information. 901.It Ic ctx 902Print process context information. 903.It Ic dtlb 904Print data translation look-aside buffer context information. 905.It Ic dtsb 906Display data translation storage buffer information. 907.It Ic kmap 908Display information about the listed mapping in the kernel pmap. Use the 909.Dq f 910modifier to get a full listing. 911.It Ic pcb 912Display information about the 913.Dq struct pcb 914listed. 915.It Ic pctx 916Attempt to change process context. 917.It Ic page 918Display the pointer to the 919.Dq struct vm_page 920for this physical address. 921.It Ic phys 922Display physical memory. 923.It Ic pmap 924Display the pmap. Use the 925.Dq f 926modifier to get a fuller listing. 927.It Ic proc 928Display some information about the process pointed to, or curproc. 929.It Ic prom 930Enter the OFW prom. 931.It Ic pv 932Display the 933.Dq struct pv_entry 934pointed to. 935.It Ic stack 936Dump the window stack. Use the 937.Dq u 938modifier to get userland information. 939.It Ic tf 940Display full trap frame state. This is most useful for inclusion with 941bug reports. 942.It Ic ts 943Display trap state. 944.It Ic traptrace 945Display or set trap trace information. Use the 946.Dq r 947and 948.Dq f 949modifiers to get reversed and full information, respectively. 950.It Ic uvmdump 951Dumps the UVM histories. 952.It Ic watch 953Set or clear a physical or virtual hardware watchpoint. Pass the address 954to be watched, or 955.Dq 0 956to clear the watchpoint. Append 957.Dq p 958to the watch point to use the physical watchpoint registers. 959.It Ic window 960Print register window information about given address. 961.El 962.Ss SUN3 and SUN3X 963.Bl -tag -width "intrchain" -compact 964.It Ic abort 965Drop into monitor via abort (allows continue). 966.It Ic halt 967Exit to Sun PROM monitor as in 968.Xr halt 8 . 969.It Ic reboot 970Reboot the machine as in 971.Xr reboot 8 . 972.It Ic pgmap 973Given an address, print the address, segment map, page map, and 974Page Table Entry (PTE). 975.El 976.Sh VARIABLES 977.Nm 978accesses registers and variables as 979.Cm $ Ns Ar name . 980Register names are as per the 981.Ic "show registers" 982command. 983Some variables are suffixed with numbers, and may have a modifier 984following a colon immediately after the variable name. 985For example, register variables may have a 986.Sq u 987modifier to indicate user register 988(e.g., 989.Li "$eax:u" ) . 990.Pp 991Built-in variables currently supported are: 992.Bl -tag -offset indent -width "maxwidth" -compact 993.It Va lines 994The number of lines. 995This is used by the 996.Ic more 997feature. 998.It Va maxoff 999Addresses are printed as 1000.Li 'symbol'+offset 1001unless 1002.Li offset 1003is greater than 1004.Va maxoff . 1005.It Va maxwidth 1006The width of the displayed line. 1007.It Va onpanic 1008If non-zero (the default), 1009.Nm 1010will be invoked when the kernel panics. 1011If the kernel configuration option 1012.D1 Cd options DDB_ONPANIC=0 1013is used, 1014.Va onpanic 1015will be initialized to off. 1016.It Va fromconsole 1017If non-zero (the default), 1018the kernel allows to enter 1019.Nm 1020from the console (by break signal or special key sequence). 1021If the kernel configuration option 1022.D1 Cd options DDB_FROMCONSOLE=0 1023is used, 1024.Va fromconsole 1025will be initialized to off. 1026.It Va radix 1027Input and output radix. 1028.It Va tabstops 1029Tab stop width. 1030.\" .It Va work Ns Sy xx 1031.\" Temporary work variable. 1032.\" .Sq Sy xx 1033.\" is between 0 and 31. 1034.El 1035.Pp 1036All built-in variables are accessible via 1037.Xr sysctl 3 . 1038.Sh EXPRESSIONS 1039Almost all expression operators in C are supported, except 1040.Sq \&~ , 1041.Sq \&^ , 1042and unary 1043.Sq \&\*[Am] . 1044Special rules in 1045.Nm 1046are: 1047.Bl -tag -offset indent -width "identifier" 1048.It Ar identifier 1049name of a symbol. 1050It is translated to the address (or value) of it. 1051.Sq \&. 1052and 1053.Sq \&: 1054can be used in the identifier. 1055If supported by an object format dependent routine, 1056.Sm off 1057.Xo 1058.Oo Ar filename : Oc 1059.Ar function 1060.Oo : Ar "line number" Oc , 1061.Xc 1062.Xo 1063.Oo Ar filename : Oc 1064.Ar variable , 1065.Xc 1066and 1067.Xo 1068.Ar filename 1069.Oo : Ar "line number" Oc , 1070.Xc 1071.Sm on 1072can be accepted as a symbol. 1073The symbol may be prefixed with 1074.Ar symbol_table_name : : 1075(e.g., 1076.Li emulator::mach_msg_trap ) 1077to specify other than kernel symbols. 1078.It Ar number 1079number. 1080Radix is determined by the first two characters: 1081.Sq 0x 1082- hex, 1083.Sq 0o 1084- octal, 1085.Sq 0t 1086- decimal, 1087otherwise follow current radix. 1088.It Cm . 1089.Ar dot 1090.It Cm + 1091.Ar next 1092.It Cm .. 1093address of the start of the last line examined. 1094Unlike 1095.Ar dot 1096or 1097.Ar next , 1098this is only changed by the 1099.Ic examine 1100or 1101.Ic write 1102commands. 1103.It Cm \&" 1104last address explicitly specified. 1105.It Cm $ Ns Ar name 1106register name or variable. 1107It is translated to the value of it. 1108It may be followed by a 1109.Sq \&: 1110and modifiers as described above. 1111.It Cm a 1112multiple of right-hand side. 1113.It Cm * Ns Ar expr 1114expression indirection. 1115It may be followed by a 1116.Sq \&: 1117and modifiers as described above. 1118.El 1119.Sh SEE ALSO 1120.Xr options 4 , 1121.Xr sysctl 8 1122.Sh HISTORY 1123The 1124.Nm 1125kernel debugger was written as part of the MACH project at 1126Carnegie-Mellon University. 1127