1.\" $OpenBSD: ddb.4,v 1.99 2020/10/26 18:53:20 deraadt Exp $ 2.\" $NetBSD: ddb.4,v 1.5 1994/11/30 16:22:09 jtc Exp $ 3.\" 4.\" Mach Operating System 5.\" Copyright (c) 1991,1990 Carnegie Mellon University 6.\" All Rights Reserved. 7.\" 8.\" Permission to use, copy, modify and distribute this software and its 9.\" documentation is hereby granted, provided that both the copyright 10.\" notice and this permission notice appear in all copies of the 11.\" software, derivative works or modified versions, and any portions 12.\" thereof, and that both notices appear in supporting documentation. 13.\" 14.\" CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS" 15.\" CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR 16.\" ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE. 17.\" 18.\" Carnegie Mellon requests users of this software to return to 19.\" 20.\" Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU 21.\" School of Computer Science 22.\" Carnegie Mellon University 23.\" Pittsburgh PA 15213-3890 24.\" 25.\" any improvements or extensions that they make and grant Carnegie Mellon 26.\" the rights to redistribute these changes. 27.\" 28.Dd $Mdocdate: October 26 2020 $ 29.Dt DDB 4 30.Os 31.Sh NAME 32.Nm ddb 33.Nd kernel debugger 34.Sh DESCRIPTION 35The 36.Nm 37debugger provides a means for debugging the kernel, 38and analysing the kernel after a system crash ("panic"), with a 39.Xr gdb 1 Ns \&-like 40syntax. 41.Pp 42.Nm 43is invoked upon a kernel panic when the 44.Xr sysctl 8 45.Va ddb.panic 46is set to 1. 47It may be invoked from the console when the sysctl 48.Va ddb.console 49is set to 1, using any of the following methods: 50.Bl -dash -offset 3n 51.It 52Using the key sequence 53.Li Ctrl-Alt-Esc . 54.It 55Sending a 56.Dv BREAK 57when using a serial console. 58.It 59Writing to the sysctl 60.Va ddb.trigger . 61.It 62For i386 and amd64 architectures, 63using the key sequence 64.Li Ctrl-Alt-Delete 65when the sysctl 66.Va machdep.kbdreset 67is set to 2. 68.El 69.Pp 70.Nm 71prompts for commands on the console with: 72.Pp 73.Dl ddb> 74.Pp 75The general syntax of a 76.Nm 77command is: 78.Bd -ragged -offset indent 79.Ar command 80.Oo Ic / Ns Ar modifiers Oc " " 81.Oo Ar address Oc Ns 82.Op Ic \&, Ns Ar count 83.Ed 84.Pp 85To save typing, 86.Nm 87makes use of a context inferred from previous commands. 88In this context, 89the current location is called 90.Va dot . 91.\" The 92.\" .Va dot 93.\" is displayed with 94.\" a hexadecimal format at a prompt. 95The 96.Ic examine , 97.Ic search , 98.Ic show struct , 99and 100.Ic write 101commands update 102.Va dot 103to be that of the last address 104examined or the last location modified, and 105have intuitive effects on 106.Va next 107and 108.Va prev . 109All the other commands do not change 110.Va dot , 111and set 112.Va next 113to be the same. 114(See 115.Sx VARIABLES . ) 116.Pp 117.\" Specifying 118.\" .Ar address 119.\" in a command sets 120.\" .Va dot . 121An expression can be used in place of 122.Ar address 123(see 124.Sx EXPRESSIONS ) . 125Omitting 126.Ar address 127in a command uses the last value of 128.Va dot . 129A missing 130.Ar count 131is taken to be 1 for printing commands or \*(If 132for stack traces. 133Entering a blank line causes the last command to be repeated using 134.Va next 135in place of 136.Ar address , 137a 138.Ar count 139of 1, and no modifiers. 140.Pp 141.Nm 142has a feature like 143.Xr more 1 144for the output. 145If the number of lines output in response to one command exceeds the number 146set in the 147.Va $lines 148variable, it displays the message 149.Ql "--db_more--" 150and waits for a response. 151.Pp 152The valid responses are: 153.Pp 154.Bl -tag -width 10n -offset indent -compact 155.It Aq Ic space 156One more page. 157.It Aq Ic return 158One more line. 159.It Ic q 160Abort the current command, and return to the command input mode. 161.El 162.Pp 163The following command line editing keys are provided: 164.Pp 165.Bl -tag -width 10n -offset indent -compact 166.It Ic ^b 167back one character 168.It Ic ^f 169forward one character 170.It Ic ^a 171beginning of line 172.It Ic ^e 173end of line 174.It Ic ^w 175erase word back 176.It Ic ^h | Aq Ic del 177erase previous character 178.It Ic ^d 179erase next character 180.It Ic ^k 181delete to end of line 182.It Ic ^u 183delete line 184.It Ic ^p 185previous in command history 186.It Ic ^n 187next in command history 188.It Ic ^r 189redraw line 190.It Ic ^t 191exchange the two characters to the left of the cursor 192.El 193.Sh COMMANDS 194The following commands may be typed at the 195.Ql ddb> 196prompt. 197Some commands consist of more than one word, and if only the first word 198or words are entered, the possible alternatives to complete the command 199are displayed and no other action is performed. 200.Bl -tag -width 10n 201.\" -------------------- 202.It Ic help 203List the available commands. 204.\" -------------------- 205.Tg examine 206.It Xo 207.Oo Ic e Oc Ns 208.Ic x Ns Op Ic amine 209.Op Cm /bhlqaAxzodurcsmiI 210.Op Ar addr Ns 211.Op Ic \&, Ns Ar count 212.Xc 213Display the contents at address 214.Ar addr 215according to the formats in the modifier. 216If no format is specified, the last formats specified for this command 217are used. 218.Pp 219The format characters are: 220.Pp 221.Bl -tag -width 4n -compact 222.It Cm /b 223look at by bytes (8 bits) 224.It Cm /h 225look at by half words (16 bits) 226.It Cm /l 227look at by long words (32 bits) (default) 228.It Cm /q 229look at by long longs (64 bits) (only available on 64-bit platforms) 230.It Cm /a 231print the location being displayed 232.It Cm /A 233print the location with a line number if possible 234.It Cm /x 235display in unsigned hex 236.It Cm /z 237display in signed hex 238.It Cm /o 239display in unsigned octal 240.It Cm /d 241display in signed decimal 242.It Cm /u 243display in unsigned decimal 244.It Cm /r 245display in current radix, signed 246.It Cm /c 247display low 8 bits as a character. 248Non-printing characters are displayed as an octal escape code (e.g., '\e000'). 249.It Cm /s 250display the null-terminated string at the location. 251Non-printing characters are displayed as octal escapes. 252.It Cm /m 253display in unsigned hex with character dump at the end of each line. 254The location is also displayed in hex at the beginning of each line. 255.It Cm /i 256display as an instruction 257.It Cm /I 258display as an alternate format instruction depending on the 259machine: 260.Pp 261.Bl -tag -width powerpc_ -compact 262.It alpha 263Print affected register contents for every instruction. 264.It amd64 , 265.It i386 266Do not skip padding to the next long word boundary for unconditional jumps. 267.It m88k 268Decode instructions for the opposite CPU model (e.g. m88110 when running on an 269m88100 processor). 270.El 271.El 272.Pp 273The value of 274.Va next 275is set to the 276.Ar addr 277plus the size of the data examined. 278.\" -------------------- 279.Tg print 280.It Xo 281.Ic p Ns Op Ic rint 282.Op Cm /axzodurc 283.Op Ar addr 284.Xc 285Print 286.Ar addr 287according to the modifier character. 288The valid modifiers are a subset of those from the 289.Ic examine 290command, and act as described there. 291If no modifier is specified, the last one specified in a 292previous use of 293.Ic print 294is used. 295.Pp 296For example, 297.Bd -literal -offset indent 298print/x $eax 299.Ed 300.Pp 301will print something like this: 302.Bd -literal -offset indent 303xxxxxx 304.Ed 305.\" -------------------- 306.Tg pprint 307.It Xo 308.Ic pp Ns Op Ic rint 309.Op Ar addr 310.Xc 311Pretty-print 312.Ar addr 313using CTF debug symbols included in the kernel binary image. 314The CTF section is normally added by running 315.Xr ctfstrip 1 316as part of building a new kernel. 317.\" -------------------- 318.\" .It Xo Ic w Ns Op Cm /bhl 319.\" .Op Ar addr 320.\" .Ar expr Op expr ... 321.\" .Xc 322.Tg write 323.It Xo 324.Ic w Ns Op Ic rite 325.Op Cm /bhl 326.Op Ar addr 327.Ar expr Op Ar expr ... 328.Xc 329Write the value of each 330.Ar expr 331expression at succeeding locations start at 332.Ar addr . 333The write unit size can be specified using one of the modifiers: 334.Pp 335.Bl -tag -width 4n -offset indent -compact 336.It Cm /b 337byte (8 bits) 338.It Cm /h 339half word (16 bits) 340.It Cm /l 341long word (32 bits) (default) 342.El 343.Pp 344The value of 345.Va next 346is set to 347.Ar addr 348plus the size of values written. 349.Pp 350.Sy Warning : 351since there is no delimiter between expressions, the 352command may not parse as you expect. 353It is best to enclose each expression in parentheses. 354.\" -------------------- 355.It Xo Ic set 356.Ic $ Ns Ar name 357.Op Ic = 358.Ar expr 359.Xc 360Set the named variable or register with the value of 361.Ar expr . 362For valid variable names, 363see 364.Sx VARIABLES . 365.\" -------------------- 366.It Ic boot Ar how 367Reboot the machine depending on 368.Ar how : 369.Pp 370.Bl -tag -width "boot poweroff" -compact 371.It Ic boot sync 372Sync disks and reboot. 373.It Ic boot crash 374Dump core and reboot. 375.It Ic boot dump 376Sync disks, dump core and reboot. 377.It Ic boot halt 378Just halt. 379.It Ic boot reboot 380Just reboot. 381.It Ic boot poweroff 382Power down the machine whenever possible; if it fails, just halt. 383.El 384.\" -------------------- 385.It Xo 386.Ic break 387.Op Ar addr Ns 388.Op Ic \&, Ns Ar count 389.Xc 390Set a break point at 391.Ar addr . 392If 393.Ar count 394is supplied, 395.Nm 396allows the breakpoint to be silently hit 397.Ar ( count No \- 1 ) 398times before stopping at the 399break point. 400.\" -------------------- 401.Tg delete 402.It Xo 403.Ic d Ns Op Ic elete 404.Op Ar addr 405.Xc 406Delete the break point set with the 407.Ic break 408command. 409.\" -------------------- 410.\" .It Xo Ic s Ns Op Cm /p 411.\" .Op Ic \&, Ns Ar count 412.\" .Xc 413.Tg step 414.It Xo 415.Ic s Ns Op Ic tep 416.Op Cm /p 417.Op Ic \&, Ns Ar count 418.Xc 419Single step 420.Ar count 421times. 422If the 423.Cm /p 424modifier is specified, print each instruction at each step. 425Otherwise, only print the last instruction. 426.Pp 427.Sy Warning : 428depending on machine type, it may not be possible to 429single-step through some low-level code paths. 430On machines with software-emulated single-stepping (e.g., alpha), 431stepping through code executed by interrupt handlers will probably 432do the wrong thing. 433.\" -------------------- 434.It Ic call Ar name Ns Xo 435.Ic \&( Ns Ar expr 436.Op Ic \&, Ar expr ... 437.Ic \&) 438.Xc 439Call the function named by 440.Ar name 441with the argument(s) listed in parentheses. 442Parentheses may be omitted if the function takes no arguments. 443The number of arguments is currently limited to 10. 444.\" -------------------- 445.\" .It Ic c Ns Op Cm /c 446.Tg continue 447.It Xo 448.Ic c Ns Op Ic ontinue 449.Op Cm /c 450.Xc 451Continue execution until a breakpoint or watchpoint. 452If the 453.Cm /c 454modifier is given, instructions are counted while executing. 455.Pp 456.Sy Warning : 457when counting with 458.Cm /c , 459.Nm 460is really silently single-stepping. 461This means that single-stepping on low-level code may cause strange 462behavior. 463.\" -------------------- 464.It Xo 465.Ic watch 466.Ar addr 467.Op Ic \&, Ns Ar size 468.Xc 469Set a watchpoint for the region starting at 470.Ar addr . 471Execution stops and control returns to 472.Nm 473when an attempt is made to modify a watched region. 474The 475.Ar size 476argument defaults to 4. 477.Pp 478If you specify a wrong space address, the request is rejected 479with an error message. 480.Pp 481.Sy Warning : 482attempts to watch wired kernel memory 483may cause an unrecoverable error on some systems (e.g., i386). 484.\" -------------------- 485.It Ic dwatch Ar addr 486Delete the watchpoint at address 487.Ar addr 488that was previously set with a 489.Ic watch 490command. 491.\" -------------------- 492.It Xo 493.Ic hangman 494.Op Cm /s Ns Op Ic 0-9 495.Xc 496This is a tiny and handy tool for random kernel hangs analysis, of which its 497depth is controlled by the optional argument of the default value of five. 498It uses some sophisticated heuristics to spot the global symbol that 499caused the hang. 500Since the discovering algorithm is a probabilistic one, 501you may spend substantial time to figure the exact symbol name. 502This smart thing requires a little of your attention, the input it accepts 503is mostly of the same format as that of the famous 504.Xr hangman 6 505game, to which it, apparently, is obliged by the name. 506Hint: the 507.Xr nm 1 508utility might help. 509.\" -------------------- 510.It Ic until Op Cm /p 511Stop at the next 512.Qq call 513or 514.Qq return 515instruction. 516If the 517.Cm /p 518modifier is specified, 519.Nm 520prints the call nesting depth and the 521cumulative instruction count at each call or return. 522Otherwise, it stays silent until the matching return is hit. 523.\" -------------------- 524.It Ic match Op Cm /p 525Stop at the next matching return instruction. 526If the 527.Cm /p 528modifier is specified, 529.Nm 530prints the call nesting depth and the 531cumulative instruction count at each call or return. 532Otherwise, it remains mostly quiet. 533.\" -------------------- 534.It Ic next Op Cm /p 535The 536.Ic next 537command is a synonym for 538.Ic match . 539.\" -------------------- 540.It Ic kill Ar pid 541Send an uncatchable 542.Dv SIGABRT 543signal to the process specified by the 544.Ar pid 545argument. 546.\" -------------------- 547.It Xo 548.Ic trace 549.Op Cm /tu 550.Op Ar frameaddr Ns 551.Op Ic \&, Ns Ar count 552.Xc 553Show the stack trace. 554The 555.Cm /t 556modifier interprets the 557.Ar frameaddr 558argument as the TID of a process and shows the stack trace of 559that process. 560.Ar frameaddr 561is subject to the radix; use the 0t prefix to enter a decimal TID. 562The 563.Cm /t 564modifier is not supported on all platforms. 565The 566.Cm /u 567modifier shows the stack trace of user space; 568if omitted, the kernel stack is traced instead. 569The 570.Ar count 571argument is the limit on the number of frames to be followed. 572If 573.Ar count 574is omitted, all frames are printed. 575.Pp 576.Sy Warning : 577user space stack trace is valid 578only if the machine dependent code supports it. 579.\" -------------------- 580.It Xo 581.Ic search 582.Op Cm /bhl 583.Op Ar addr 584.Ar value 585.Op Ar mask 586.Op Ic \&, Ns Ar count 587.Xc 588Search memory for a value beginning at 589.Ar addr . 590This command might fail in interesting 591ways if it doesn't find the searched-for value. 592This is because 593.Nm 594doesn't always recover from touching bad memory. 595The optional 596.Ar count 597argument limits the search. 598The modifiers are the same as those of the 599.Ic write 600command. 601.Pp 602The 603.Va next 604address is set to the address where 605.Ar value 606is found, or just after where the search area finishes. 607.\" -------------------- 608.It Ic reboot 609Shortcut for 610.Ic boot reboot 611.\" -------------------- 612.It Ic show Ar what 613Displays various things, depending on 614.Ar what : 615.Bl -tag -width 4n 616.\" -------------------- 617.It Ic show bcstats 618Prints the buffer cache statistics. 619.\" -------------------- 620.It Ic show breaks 621Prints a list of all breakpoints that have been set with the 622.Ic break 623command. 624.\" -------------------- 625.It Xo 626.Ic show buf 627.Op Cm /f 628.Ar addr 629.Xc 630Prints the 631.Li struct buf 632at 633.Ar addr . 634If the 635.Cm /f 636modifier is specified output will also include 637.Li softdep 638printout, if those are available. 639.\" -------------------- 640.It Ic show extents 641Prints a detailed list of all extents. 642.\" -------------------- 643.It Ic show locks Op Ar addr 644Prints the list of locks held by a thread. 645If an optional address is not specified, 646.Li curproc 647is assumed. 648The 649.Cm option WITNESS 650is required for this command to be available. 651.\" -------------------- 652.It Ic show malloc Op Ar addr 653Prints malloc debugging information if available. 654If an optional address is specified, only information about that address 655is printed. 656.\" -------------------- 657.It Xo 658.Ic show map 659.Op Cm /f 660.Ar addr 661.Xc 662Prints the 663.Li vm_map 664at 665.Ar addr . 666If the 667.Cm /f 668modifier is specified the complete map is printed. 669.\" -------------------- 670.It Ic show mbuf Ar addr 671Prints the 672.Li struct mbuf 673header at 674.Ar addr . 675Depending on the mbuf flags 676.Li struct pkthdr 677and 678.Li struct m_ext 679are printed as well. 680.\" -------------------- 681.It Xo 682.Ic show mount 683.Op Cm /f 684.Ar addr 685.Xc 686Prints the 687.Li struct mount 688at 689.Ar addr . 690If the 691.Cm /f 692modifier is specified prints out all 693.Li vnodes 694(see also 695.Cm show vnode ) 696and also all 697.Li bufs 698(see also 699.Cm show buf ) 700on all those vnodes. 701.\" -------------------- 702.It Xo 703.Ic show nfsnode 704.Op Cm /f 705.Ar addr 706.Xc 707Prints the 708.Li struct nfsnode 709at 710.Ar addr . 711If the 712.Cm /f 713modifier is specified prints out additional 714information as well. 715.\" -------------------- 716.It Xo 717.Ic show nfsreq 718.Op Cm /f 719.Ar addr 720.Xc 721Prints the 722.Li struct nfsreq 723at 724.Ar addr . 725If the 726.Cm /f 727modifier is specified prints out additional 728information as well. 729.\" -------------------- 730.It Xo 731.Ic show object 732.Op Cm /f 733.Ar addr 734.Xc 735Prints the 736.Li vm_object 737at 738.Ar addr . 739If the 740.Cm /f 741modifier is specified the complete object is printed. 742.\" -------------------- 743.It Xo 744.Ic show page 745.Op Cm /f 746.Ar addr 747.Xc 748Prints the 749.Li vm_page 750at 751.Ar addr . 752If the 753.Cm /f 754modifier is specified the complete page is printed. 755.\" -------------------- 756.It Ic show panic 757Prints the panic string. 758.\" -------------------- 759.It Xo 760.Ic show pool 761.Op Cm /p 762.Ar addr 763.Xc 764Prints the 765.Li pool 766at 767.Ar addr . 768Valid modifiers: 769.Bl -tag -width xxx -compact 770.It Cm /p 771Print the pagelist for this pool. 772.El 773.\" -------------------- 774.It Ic show proc Op Ar addr 775Prints the 776.Li struct proc 777at 778.Ar addr . 779If an optional address is not specified 780.Li curproc 781is assumed. 782.\" -------------------- 783.It Ic show registers Op Cm /u 784Display the register set. 785If the 786.Cm /u 787modifier is specified, it displays user registers (or the currently 788saved registers) instead of the kernel's. 789Note: The 790.Cm /u 791modifier is not supported on every machine, in which case 792incorrect information may be displayed. 793.\" -------------------- 794.It Ic show socket Ar addr 795Prints the 796.Li struct socket 797at 798.Ar addr . 799If the socket is spliced, the 800.Li struct sosplice 801associated with the socket is printed as well. 802.\" -------------------- 803.It Xo 804.Ic show struct 805.Ar name 806.Op addr 807.Xc 808Prints the content of the memory at 809.Ar addr 810as a struct 811.Ar name . 812Nested structures and bit fields are not printed. 813Character arrays are printed as bytes. 814.\" -------------------- 815.It Ic show uvmexp 816Displays a selection of uvm counters and statistics. 817.\" -------------------- 818.It Xo 819.Ic show vnode 820.Op Cm /f 821.Ar addr 822.Xc 823Prints the 824.Li struct vnode 825at 826.Ar addr . 827If the 828.Cm /f 829modifier is specified prints out all 830.Li bufs 831(see also 832.Cm show buf ) 833currently attached to this 834.Li vnode . 835.\" -------------------- 836.It Ic show watches 837Displays all watchpoints set with the 838.Ic watch 839command. 840.\" -------------------- 841.It Ic show witness Op Cm /b 842Prints the current order list. 843If the 844.Cm /b 845modifier is specified, the list of found lock order violations is printed 846instead. 847The 848.Cm option WITNESS 849is required for this command to be available. 850.\" -------------------- 851.It Ic show all procs Op Cm /anow 852Display information on all processes. 853.Pp 854.Bl -tag -width foo -compact 855.It Cm /n 856(Default) Show process information in a 857.Xr ps 1 Ns \&-like 858format. 859Information printed includes process ID, thread ID, parent 860process ID, UID, process status, process flags, process 861wait channel message and process command name. 862.It Cm /a 863Shows the kernel virtual addresses of each process' 864proc structure, u-area, and vmspace structure. 865The vmspace address is also the address of the process' 866.Li vm_map 867structure 868and can be used in the 869.Ic show map 870command. 871.It Cm /o 872Shows non-idle threads that were on CPU when ddb was entered. 873Information printed includes thread ID, process ID, UID, process flags, 874thread flags, current CPU, and command name. 875.It Cm /w 876Shows each thread's ID, command, process group, 877wait channel address, and wait channel message. 878.El 879.\" -------------------- 880.It Ic show all bufs Op Cm /f 881Display information about all buffers in the system. 882.Pp 883.Bl -tag -width foo -compact 884.It Cm /f 885For each buffer, print a more detailed output. 886See the 887.Ic show buf 888command for more information. 889.El 890.\" -------------------- 891.It Ic show all callout 892Display the contents of the callout table. 893.\" -------------------- 894.It Ic show all pools Op Cm /a 895Display information about all system pools in a format similar to 896.Xr vmstat 8 . 897.Pp 898.Bl -tag -width foo -compact 899.It Cm /a 900Displays 901.Dq interesting 902address information. 903.El 904.\" -------------------- 905.It Ic show all locks 906Prints the list of locks held by all threads in the system. 907The 908.Cm option WITNESS 909is required for this command to be available. 910.\" -------------------- 911.It Ic show all mounts Op Cm /f 912Display information on all mounted filesystems. 913.Pp 914.Bl -tag -width foo -compact 915.It Cm /f 916For each filesystem, list all its struct vnode addresses. 917These addresses can be used in the 918.Ic show vnode 919command. 920.El 921.\" -------------------- 922.It Ic show all nfsnodes Op Cm /f 923Display information about all nfsnodes in the system. 924.Pp 925.Bl -tag -width foo -compact 926.It Cm /f 927For each nfsnode, print a more detailed output. 928See the 929.Ic show nfsnode 930command for more information. 931.El 932.\" -------------------- 933.It Ic show all nfsreqs Op Cm /f 934Display information for all outstanding NFS requests. 935.Pp 936.Bl -tag -width foo -compact 937.It Cm /f 938For each NFS requests, print a more detailed output. 939See the 940.Ic show nfsreq 941command for more information. 942.El 943.\" -------------------- 944.It Ic show all vnodes Op Cm /f 945Display information about all vnodes in the system. 946.Pp 947.Bl -tag -width foo -compact 948.It Cm /f 949For each vnode, print a more detailed output. 950See the 951.Ic show vnode 952command for more information. 953.El 954.El 955.\" -------------------- 956.It Ic callout 957A synonym for the 958.Ic show all callout 959command. 960.\" -------------------- 961.It Ic ps Op Cm /anow 962A synonym for 963.Ic show all procs . 964.\" -------------------- 965.Tg machine 966.It Xo 967.Ic mac Ns Op Ic hine 968.Ar subcommand Op Ar args ... 969.Xc 970Perform a platform-specific command. 971.Pp 972The following commands are supported by multiprocessor kernels on 973these platforms: amd64, i386, macppc, mips64, and sparc64. 974.Pp 975.Bl -tag -width "searchframe [addr]" -compact 976.It Ic cpuinfo 977Display the state of each CPU. 978.It Ic ddbcpu Ar N 979Stop the current CPU and start handling 980.Nm 981on the selected CPU. 982.It Ic startcpu Op Ar N 983Resume normal processing on the selected CPU, 984or all CPUs if none is specified. 985.It Ic stopcpu Op Ar N 986Stop normal processing on the selected CPU, 987or all CPUs (except the one handling 988.Nm ) 989if none is specified. 990.El 991.Pp 992Other platform-specific commands: 993.\" .Pp 994.\" amd64: 995.Pp 996arm: 997.Bl -tag -width "searchframe [addr]" -compact 998.It Ic frame Ar addr 999Display the trapframe at 1000.Ar addr . 1001.El 1002.Pp 1003i386: 1004.Bl -tag -width "searchframe [addr]" -compact 1005.\" .It Ic acpi disasm Ar ?? 1006.\" .It Ic acpi showval Ar ?? 1007.\" .It Ic acpi tree Ar ?? 1008.\" .It Ic acpi trace Ar ?? 1009.\" Evil ACPI debugging magic. 1010.It Ic sysregs 1011Display the contents of the privileged registers: 1012.Va IDTR , 1013.Va GDTR , 1014.Va LDTR , 1015.Va TR , 1016.Va CR0 , 1017.Va CR2 , 1018.Va CR3 , 1019and 1020.Va CR4 . 1021.\" (i386-only) 1022.El 1023.Pp 1024m88k: 1025.Bl -tag -width "searchframe [addr]" -compact 1026.It Ic ddbcpu Ar N 1027Stop the current CPU and start handling 1028.Nm 1029on the selected CPU. 1030.It Ic frame Ar addr 1031Display the trapframe at 1032.Ar addr . 1033.It Ic regs 1034Display the registers from when 1035.Nm 1036was entered. 1037.It Ic searchframe Op Ar addr 1038Search for and display stack exception frames, 1039starting from 1040.Ar addr 1041if given, else the address in register 1042.Va r31 , 1043and stopping at the next 8k boundary. 1044.It Ic where 1045Display where the current CPU was stopped. 1046.El 1047.Pp 1048mips64: 1049.Bl -tag -width "searchframe [addr]" -compact 1050.It Xo 1051.Ic tlb Op Cm /p Ar asid 1052.Op Cm /c 1053.Op Ar tlb 1054.Xc 1055.It Ic trap Ar ?? 1056.El 1057.Pp 1058sh: 1059.Bl -tag -width "searchframe [addr]" -compact 1060.It Ic cache Op Ar addr 1061Display the cache, starting from 1062.Ar addr , 1063defaulting to 0. 1064.It Ic frame 1065Display the switch and trap frames. 1066.\" .It Ic stack 1067.It Ic tlb 1068Display the TLB. 1069.El 1070.Pp 1071sparc64: 1072.Bl -tag -width "searchframe [addr]" -compact 1073.It Ic ctx 1074Display the context addresses for all threads. 1075.\" .It Ic dtlb Ar 0,2 1076.\" .It Ic dtsb 1077.\" .It Ic esp 1078.\" .It Ic fpstate Op Ar addr 1079.\" .It Ic itlb Ar 0,1,2 1080.\" .It Ic kmap Op Ar addr 1081.\" .It Ic pcb Op Ar addr 1082.\" .It Ic pctx Ar pid 1083.\" .It Ic page Ar addr 1084.\" .It Ic phys Op Ar addr 1085.\" .It Ic pmap Op Ar addr 1086.\" .It Ic proc Op Ar addr 1087.\" .It Ic prom Ar ?? 1088.\" .It Ic pv Ar addr 1089.\" .It Ic stack Op Ar addr 1090.\" .It Ic tf Op Ar addr 1091.\" .It Ic ts 1092.\" .It Ic traptrace Op Ar addr 1093.\" .It Ic watch Op Ar addr 1094.\" .It Ic window Op Ar winnum 1095.\" .It Ic xir Op Ar addr 1096.El 1097.\" -------------------- 1098.El 1099.Sh VARIABLES 1100.Nm 1101denotes registers and variables by 1102.Ic $ Ns Va name . 1103Register names can be found with the 1104.Ic show registers 1105command. 1106.Pp 1107Some variable names are suffixed with numbers, and some may have a modifier 1108following a colon immediately after the variable name. 1109For example, register variables can have the 1110.Ql :u 1111modifier to indicate a 1112user register (e.g., 1113.Ql $eax:u ) . 1114.Pp 1115Built-in debugger variables currently supported are: 1116.Bl -tag -width 10n -compact -offset indent 1117.It Va $radix 1118Input and output radix. 1119.It Va $maxoff 1120Addresses are printed as 1121.Ar symbol Ns Li + Ns Ar offset 1122unless 1123.Ar offset 1124is greater than 1125.Va $maxoff . 1126.It Va $maxwidth 1127The width of the displayed lines. 1128.It Va $lines 1129The number of lines to page. 1130This is used by the 1131.Dq more 1132feature. 1133.It Va $tabstops 1134Tab stop width. 1135.It Va $log 1136Controls whether the output of 1137.Nm 1138will also appear in the system message 1139buffer. 1140.El 1141.Pp 1142These variables can also be controlled outside 1143.Nm 1144via the 1145.Sq ddb 1146.Xr sysctl 8 1147hierarchy. 1148.Sh EXPRESSIONS 1149Almost all expression operators in C are supported except for 1150.Ql ~ , 1151.Ql ^ , 1152and unary 1153.Ql & . 1154Special rules for expressions in 1155.Nm 1156are: 1157.Bl -tag -width 15n -compact -offset indent 1158.It Ar identifier 1159The name of a symbol. 1160It is translated to the address (or value) of the symbol. 1161.Ql \&. 1162and 1163.Ql \&: 1164can be used in the identifier. 1165The following can be accepted as an identifier, 1166if supported by an object format dependent routine: 1167.Bl -item -offset indent -compact 1168.It 1169.Sm off 1170.Oo Ar filename Li \&: Oc Ar func 1171.Op \&: Ar linenumber 1172.It 1173.Op Ar filename \&: 1174.Ar variable 1175.It 1176.Ar filename 1177.Op \&: Ar linenumber 1178.Sm on 1179.El 1180The symbol may be prefixed with 1181.Sq Ar symboltablename Ns :: 1182(e.g., 1183.Ql emulator::mach_msg_trap ) 1184to specify other than kernel symbols. 1185.It Ar number 1186The radix is determined by the first two letters: 1187.Ql 0x : 1188hex, 1189.Ql 0o : 1190octal, 1191.Ql 0t : 1192decimal, otherwise, the value of 1193.Va $radix 1194is used. 1195.It Li \&. 1196.Va dot : 1197the current address. 1198.It Li + 1199.Va next : 1200the next address. 1201.It Li .. 1202The address of the start of the last line examined. 1203Unlike 1204.Va dot 1205or 1206.Va next , 1207this is only changed by the 1208.Ic examine 1209or 1210.Ic write 1211command. 1212.It Li ' 1213The last address explicitly specified. 1214.It Li $ Ns Ar variable 1215The value of a register or variable. 1216The name may be followed by a 1217.Ql \&: 1218and modifiers as described above with 1219.Ar identifier . 1220.It Ar expr Li # Ar expr 1221A binary operator which rounds up the left hand side to the next 1222multiple of right hand side. 1223.It Li * Ns Ar expr 1224Indirection. 1225It may be followed by a ':' and modifiers as described above. 1226.El 1227.Sh SEE ALSO 1228.Xr ctfstrip 1 , 1229.Xr gdb 1 , 1230.Xr nm 1 , 1231.Xr witness 4 , 1232.Xr sysctl.conf 5 , 1233.Xr hangman 6 , 1234.Xr crash 8 , 1235.Xr sysctl 8 , 1236.Xr extent 9 , 1237.Xr pool 9 , 1238.Xr uvm_init 9 1239.Sh HISTORY 1240This kernel facility first appeared in the MACH 2 operating system 1241developed by CMU. 1242Hangman (which stands for "hangs maniacal analyzer") first appeared in 1243.Ox 1.2 . 1244