1.\" $OpenBSD: ddb.4,v 1.105 2022/12/22 19:53:22 kn Exp $ 2.\" $NetBSD: ddb.4,v 1.5 1994/11/30 16:22:09 jtc Exp $ 3.\" 4.\" Mach Operating System 5.\" Copyright (c) 1991,1990 Carnegie Mellon University 6.\" All Rights Reserved. 7.\" 8.\" Permission to use, copy, modify and distribute this software and its 9.\" documentation is hereby granted, provided that both the copyright 10.\" notice and this permission notice appear in all copies of the 11.\" software, derivative works or modified versions, and any portions 12.\" thereof, and that both notices appear in supporting documentation. 13.\" 14.\" CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS" 15.\" CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR 16.\" ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE. 17.\" 18.\" Carnegie Mellon requests users of this software to return to 19.\" 20.\" Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU 21.\" School of Computer Science 22.\" Carnegie Mellon University 23.\" Pittsburgh PA 15213-3890 24.\" 25.\" any improvements or extensions that they make and grant Carnegie Mellon 26.\" the rights to redistribute these changes. 27.\" 28.Dd $Mdocdate: December 22 2022 $ 29.Dt DDB 4 30.Os 31.Sh NAME 32.Nm ddb 33.Nd kernel debugger 34.Sh DESCRIPTION 35The 36.Nm 37debugger provides a means for debugging the kernel, 38and analysing the kernel after a system crash ("panic"), with a 39.Xr gdb 1 Ns \&-like 40syntax. 41.Pp 42.Nm 43is invoked upon a kernel panic when the 44.Xr sysctl 8 45.Va ddb.panic 46is set to 1. 47It may be invoked from the console when the sysctl 48.Va ddb.console 49is set to 1, using any of the following methods: 50.Bl -dash -offset 3n 51.It 52Using the key sequence 53.Li Ctrl-Alt-Esc . 54.It 55Sending a 56.Dv BREAK 57when using a serial console. 58.It 59Writing to the sysctl 60.Va ddb.trigger . 61.It 62For i386 and amd64 architectures, 63using the key sequence 64.Li Ctrl-Alt-Delete 65when the sysctl 66.Va machdep.kbdreset 67is set to 2. 68.El 69.Pp 70.Nm 71prompts for commands on the console with: 72.Pp 73.Dl ddb> 74.Pp 75The general syntax of a 76.Nm 77command is: 78.Bd -ragged -offset indent 79.Ar command 80.Oo Ic / Ns Ar modifiers Oc " " 81.Oo Ar address Oc Ns 82.Op Ic \&, Ns Ar count 83.Ed 84.Pp 85To save typing, 86.Nm 87makes use of a context inferred from previous commands. 88In this context, 89the current location is called 90.Va dot . 91.\" The 92.\" .Va dot 93.\" is displayed with 94.\" a hexadecimal format at a prompt. 95The 96.Ic examine , 97.Ic search , 98.Ic show struct , 99and 100.Ic write 101commands update 102.Va dot 103to be that of the last address 104examined or the last location modified, and 105have intuitive effects on 106.Va next 107and 108.Va prev . 109All the other commands do not change 110.Va dot , 111and set 112.Va next 113to be the same. 114(See 115.Sx VARIABLES . ) 116.Pp 117.\" Specifying 118.\" .Ar address 119.\" in a command sets 120.\" .Va dot . 121An expression can be used in place of 122.Ar address 123(see 124.Sx EXPRESSIONS ) . 125Omitting 126.Ar address 127in a command uses the last value of 128.Va dot . 129A missing 130.Ar count 131is taken to be 1 for printing commands or \*(If 132for stack traces. 133Entering a blank line causes the last command to be repeated using 134.Va next 135in place of 136.Ar address , 137a 138.Ar count 139of 1, and no modifiers. 140.Pp 141.Nm 142has a feature like 143.Xr more 1 144for the output. 145If the number of lines output in response to one command exceeds the number 146set in the 147.Va $lines 148variable, it displays the message 149.Ql "--db_more--" 150and waits for a response. 151.Pp 152The valid responses are: 153.Pp 154.Bl -tag -width 10n -offset indent -compact 155.It Aq Ic space 156One more page. 157.It Aq Ic return 158One more line. 159.It Ic q 160Abort the current command, and return to the command input mode. 161.El 162.Pp 163The following command line editing keys are provided: 164.Pp 165.Bl -tag -width 10n -offset indent -compact 166.It Ic ^b 167back one character 168.It Ic ^f 169forward one character 170.It Ic ^a 171beginning of line 172.It Ic ^e 173end of line 174.It Ic ^w 175erase word back 176.It Ic ^h | Aq Ic del 177erase previous character 178.It Ic ^d 179erase next character 180.It Ic ^k 181delete to end of line 182.It Ic ^u 183delete line 184.It Ic ^p 185previous in command history 186.It Ic ^n 187next in command history 188.It Ic ^r 189redraw line 190.It Ic ^t 191exchange the two characters to the left of the cursor 192.El 193.Sh COMMANDS 194The following commands may be typed at the 195.Ql ddb> 196prompt. 197Some commands consist of more than one word, and if only the first word 198or words are entered, the possible alternatives to complete the command 199are displayed and no other action is performed. 200.Bl -tag -width 10n 201.\" -------------------- 202.It Ic help 203List the available commands. 204.\" -------------------- 205.Tg examine 206.It Xo 207.Oo Ic e Oc Ns 208.Ic x Ns Op Ic amine 209.Op Cm /bhlqaAxzodurcsmiI 210.Op Ar addr Ns 211.Op Ic \&, Ns Ar count 212.Xc 213Display the contents at address 214.Ar addr 215according to the formats in the modifier. 216If no format is specified, the last formats specified for this command 217are used. 218.Pp 219The format characters are: 220.Pp 221.Bl -tag -width 4n -compact 222.It Cm /b 223look at by bytes (8 bits) 224.It Cm /h 225look at by half words (16 bits) 226.It Cm /l 227look at by long words (32 bits) (default) 228.It Cm /q 229look at by long longs (64 bits) (only available on 64-bit platforms) 230.It Cm /a 231print the location being displayed 232.It Cm /A 233print the location with a line number if possible 234.It Cm /x 235display in unsigned hex 236.It Cm /z 237display in signed hex 238.It Cm /o 239display in unsigned octal 240.It Cm /d 241display in signed decimal 242.It Cm /u 243display in unsigned decimal 244.It Cm /r 245display in current radix, signed 246.It Cm /c 247display low 8 bits as a character. 248Non-printing characters are displayed as an octal escape code (e.g., '\e000'). 249.It Cm /s 250display the null-terminated string at the location. 251Non-printing characters are displayed as octal escapes. 252.It Cm /m 253display in unsigned hex with character dump at the end of each line. 254The location is also displayed in hex at the beginning of each line. 255.It Cm /i 256display as an instruction 257.It Cm /I 258display as an alternate format instruction depending on the 259machine: 260.Pp 261.Bl -tag -width powerpc_ -compact 262.It alpha 263Print affected register contents for every instruction. 264.It amd64 , 265.It i386 266Do not skip padding to the next long word boundary for unconditional jumps. 267.It m88k 268Decode instructions for the opposite CPU model (e.g. m88110 when running on an 269m88100 processor). 270.El 271.El 272.Pp 273The value of 274.Va next 275is set to the 276.Ar addr 277plus the size of the data examined. 278.\" -------------------- 279.Tg print 280.It Xo 281.Ic p Ns Op Ic rint 282.Op Cm /axzodurc 283.Op Ar addr 284.Xc 285Print 286.Ar addr 287according to the modifier character. 288The valid modifiers are a subset of those from the 289.Ic examine 290command, and act as described there. 291If no modifier is specified, the last one specified in a 292previous use of 293.Ic print 294is used. 295.Pp 296For example, 297.Bd -literal -offset indent 298print/x $eax 299.Ed 300.Pp 301will print something like this: 302.Bd -literal -offset indent 303xxxxxx 304.Ed 305.\" -------------------- 306.Tg pprint 307.It Xo 308.Ic pp Ns Op Ic rint 309.Op Ar addr 310.Xc 311Pretty-print 312.Ar addr 313using CTF debug symbols included in the kernel binary image. 314The CTF section is normally added by running 315.Xr ctfstrip 1 316as part of building a new kernel. 317.\" -------------------- 318.\" .It Xo Ic w Ns Op Cm /bhl 319.\" .Op Ar addr 320.\" .Ar expr Op expr ... 321.\" .Xc 322.Tg write 323.It Xo 324.Ic w Ns Op Ic rite 325.Op Cm /bhl 326.Op Ar addr 327.Ar expr Op Ar expr ... 328.Xc 329Write the value of each 330.Ar expr 331expression at succeeding locations start at 332.Ar addr . 333The write unit size can be specified using one of the modifiers: 334.Pp 335.Bl -tag -width 4n -offset indent -compact 336.It Cm /b 337byte (8 bits) 338.It Cm /h 339half word (16 bits) 340.It Cm /l 341long word (32 bits) (default) 342.El 343.Pp 344The value of 345.Va next 346is set to 347.Ar addr 348plus the size of values written. 349.Pp 350.Sy Warning : 351since there is no delimiter between expressions, the 352command may not parse as you expect. 353It is best to enclose each expression in parentheses. 354.\" -------------------- 355.It Xo Ic set 356.Ic $ Ns Ar name 357.Op Ic = 358.Ar expr 359.Xc 360Set the named variable or register with the value of 361.Ar expr . 362For valid variable names, 363see 364.Sx VARIABLES . 365.\" -------------------- 366.It Ic boot Ar how 367Reboot the machine depending on 368.Ar how : 369.Pp 370.Bl -tag -width "boot poweroff" -compact 371.It Ic boot sync 372Sync disks and reboot. 373.It Ic boot crash 374Dump core and reboot. 375.It Ic boot dump 376Sync disks, dump core and reboot. 377.It Ic boot halt 378Just halt. 379.It Ic boot reboot 380Just reboot. 381.It Ic boot poweroff 382Power down the machine whenever possible; if it fails, just halt. 383.El 384.\" -------------------- 385.It Xo 386.Ic break 387.Op Ar addr Ns 388.Op Ic \&, Ns Ar count 389.Xc 390Set a break point at 391.Ar addr . 392If 393.Ar count 394is supplied, 395.Nm 396allows the breakpoint to be silently hit 397.Ar ( count No \- 1 ) 398times before stopping at the 399break point. 400.\" -------------------- 401.Tg delete 402.It Xo 403.Ic d Ns Op Ic elete 404.Op Ar addr 405.Xc 406Delete the break point set with the 407.Ic break 408command. 409.\" -------------------- 410.\" .It Xo Ic s Ns Op Cm /p 411.\" .Op Ic \&, Ns Ar count 412.\" .Xc 413.Tg step 414.It Xo 415.Ic s Ns Op Ic tep 416.Op Cm /p 417.Op Ic \&, Ns Ar count 418.Xc 419Single step 420.Ar count 421times. 422If the 423.Cm /p 424modifier is specified, print each instruction at each step. 425Otherwise, only print the last instruction. 426.Pp 427.Sy Warning : 428depending on machine type, it may not be possible to 429single-step through some low-level code paths. 430On machines with software-emulated single-stepping (e.g., alpha), 431stepping through code executed by interrupt handlers will probably 432do the wrong thing. 433.\" -------------------- 434.It Ic call Ar name Ns Xo 435.Ic \&( Ns Ar expr 436.Op Ic \&, Ar expr ... 437.Ic \&) 438.Xc 439Call the function named by 440.Ar name 441with the argument(s) listed in parentheses. 442Parentheses may be omitted if the function takes no arguments. 443The number of arguments is currently limited to 10. 444.\" -------------------- 445.\" .It Ic c Ns Op Cm /c 446.Tg continue 447.It Xo 448.Ic c Ns Op Ic ontinue 449.Op Cm /c 450.Xc 451Continue execution until a breakpoint or watchpoint. 452If the 453.Cm /c 454modifier is given, instructions are counted while executing. 455.Pp 456.Sy Warning : 457when counting with 458.Cm /c , 459.Nm 460is really silently single-stepping. 461This means that single-stepping on low-level code may cause strange 462behavior. 463.\" -------------------- 464.It Xo 465.Ic watch 466.Ar addr 467.Op Ic \&, Ns Ar size 468.Xc 469Set a watchpoint for the region starting at 470.Ar addr . 471Execution stops and control returns to 472.Nm 473when an attempt is made to modify a watched region. 474The 475.Ar size 476argument defaults to 4. 477.Pp 478If you specify a wrong space address, the request is rejected 479with an error message. 480.Pp 481.Sy Warning : 482attempts to watch wired kernel memory 483may cause an unrecoverable error on some systems (e.g., i386). 484.\" -------------------- 485.It Ic dwatch Ar addr 486Delete the watchpoint at address 487.Ar addr 488that was previously set with a 489.Ic watch 490command. 491.\" -------------------- 492.It Xo 493.Ic hangman 494.Op Cm /s Ns Op Ic 0-9 495.Xc 496This is a tiny and handy tool for random kernel hangs analysis, of which its 497depth is controlled by the optional argument of the default value of five. 498It uses some sophisticated heuristics to spot the global symbol that 499caused the hang. 500Since the discovering algorithm is a probabilistic one, 501you may spend substantial time to figure the exact symbol name. 502This smart thing requires a little of your attention, the input it accepts 503is mostly of the same format as that of the famous 504.Xr hangman 6 505game, to which it, apparently, is obliged by the name. 506Hint: the 507.Xr nm 1 508utility might help. 509.\" -------------------- 510.It Ic until Op Cm /p 511Stop at the next 512.Qq call 513or 514.Qq return 515instruction. 516If the 517.Cm /p 518modifier is specified, 519.Nm 520prints the call nesting depth and the 521cumulative instruction count at each call or return. 522Otherwise, it stays silent until the matching return is hit. 523.\" -------------------- 524.It Ic match Op Cm /p 525Stop at the next matching return instruction. 526If the 527.Cm /p 528modifier is specified, 529.Nm 530prints the call nesting depth and the 531cumulative instruction count at each call or return. 532Otherwise, it remains mostly quiet. 533.\" -------------------- 534.It Ic next Op Cm /p 535The 536.Ic next 537command is a synonym for 538.Ic match . 539.\" -------------------- 540.It Ic kill Ar pid 541Send an uncatchable 542.Dv SIGABRT 543signal to the process specified by the 544.Ar pid 545argument. 546.\" -------------------- 547.It Xo 548.Ic trace 549.Op Cm /tu 550.Op Ar frameaddr Ns 551.Op Ic \&, Ns Ar count 552.Xc 553Show the stack trace. 554The 555.Cm /t 556modifier interprets the 557.Ar frameaddr 558argument as the TID of a process and shows the stack trace of 559that process. 560.Ar frameaddr 561is subject to the radix; use the 0t prefix to enter a decimal TID. 562The 563.Cm /t 564modifier is not supported on all platforms. 565The 566.Cm /u 567modifier shows the stack trace of user space; 568if omitted, the kernel stack is traced instead. 569The 570.Ar count 571argument is the limit on the number of frames to be followed. 572If 573.Ar count 574is omitted, all frames are printed. 575.Pp 576.Sy Warning : 577user space stack trace is valid 578only if the machine dependent code supports it. 579.\" -------------------- 580.It Xo 581.Ic search 582.Op Cm /bhl 583.Op Ar addr 584.Ar value 585.Op Ar mask 586.Op Ic \&, Ns Ar count 587.Xc 588Search memory for a value beginning at 589.Ar addr . 590This command might fail in interesting 591ways if it doesn't find the searched-for value. 592This is because 593.Nm 594doesn't always recover from touching bad memory. 595The optional 596.Ar count 597argument limits the search. 598The modifiers are the same as those of the 599.Ic write 600command. 601.Pp 602The 603.Va next 604address is set to the address where 605.Ar value 606is found, or just after where the search area finishes. 607.\" -------------------- 608.It Ic reboot 609Shortcut for 610.Ic boot reboot 611.\" -------------------- 612.It Ic show Ar what 613Displays various things, depending on 614.Ar what : 615.Bl -tag -width 4n 616.\" -------------------- 617.It Ic show bcstats 618Prints the buffer cache statistics. 619.\" -------------------- 620.It Ic show breaks 621Prints a list of all breakpoints that have been set with the 622.Ic break 623command. 624.\" -------------------- 625.It Xo 626.Ic show buf 627.Op Cm /f 628.Ar addr 629.Xc 630Prints the 631.Vt struct buf 632at 633.Ar addr . 634If the 635.Cm /f 636modifier is specified output will also include 637.Li softdep 638printout, if those are available. 639.\" -------------------- 640.It Ic show extents 641Prints a detailed list of all extents. 642.\" -------------------- 643.It Ic show locks Op Ar addr 644Prints the list of locks held by a thread. 645If an optional address is not specified, 646.Li curproc 647is assumed. 648The 649.Cm option WITNESS 650is required for this command to be available. 651.\" -------------------- 652.It Ic show malloc Op Ar addr 653Prints malloc debugging information if available. 654If an optional address is specified, only information about that address 655is printed. 656.\" -------------------- 657.It Xo 658.Ic show map 659.Op Cm /f 660.Ar addr 661.Xc 662Prints the 663.Li vm_map 664at 665.Ar addr . 666If the 667.Cm /f 668modifier is specified, the complete map is printed. 669.\" -------------------- 670.It Ic show mbuf Ar addr 671Prints the 672.Vt struct mbuf 673header at 674.Ar addr . 675Depending on the mbuf flags 676.Vt struct pkthdr 677and 678.Vt struct m_ext 679are printed as well. 680.\" -------------------- 681.It Xo 682.Ic show mount 683.Op Cm /f 684.Ar addr 685.Xc 686Prints the 687.Vt struct mount 688at 689.Ar addr . 690If the 691.Cm /f 692modifier is specified, prints out all 693.Li vnodes 694(see also 695.Cm show vnode ) 696and also all 697.Li bufs 698(see also 699.Cm show buf ) 700on all those vnodes. 701.\" -------------------- 702.It Xo 703.Ic show nfsnode 704.Op Cm /f 705.Ar addr 706.Xc 707Prints the 708.Vt struct nfsnode 709at 710.Ar addr . 711If the 712.Cm /f 713modifier is specified, prints out additional 714information as well. 715.\" -------------------- 716.It Xo 717.Ic show nfsreq 718.Op Cm /f 719.Ar addr 720.Xc 721Prints the 722.Vt struct nfsreq 723at 724.Ar addr . 725If the 726.Cm /f 727modifier is specified, prints out additional 728information as well. 729.\" -------------------- 730.It Xo 731.Ic show object 732.Op Cm /f 733.Ar addr 734.Xc 735Prints the 736.Li vm_object 737at 738.Ar addr . 739If the 740.Cm /f 741modifier is specified, the complete object is printed. 742.\" -------------------- 743.It Xo 744.Ic show page 745.Op Cm /f 746.Ar addr 747.Xc 748Prints the 749.Li vm_page 750at 751.Ar addr . 752If the 753.Cm /f 754modifier is specified, the complete page is printed. 755.\" -------------------- 756.It Ic show panic 757Prints the panic string. 758.\" -------------------- 759.It Xo 760.Ic show pool 761.Op Cm /p 762.Ar addr 763.Xc 764Prints the 765.Li pool 766at 767.Ar addr . 768Valid modifiers: 769.Bl -tag -width xxx -compact 770.It Cm /p 771Print the pagelist for this pool. 772.El 773.\" -------------------- 774.It Ic show proc Op Ar addr 775Prints the 776.Vt struct proc 777at 778.Ar addr . 779If an optional address is not specified, 780.Li curproc 781is assumed. 782.\" -------------------- 783.It Ic show registers Op Cm /u 784Display the register set. 785If the 786.Cm /u 787modifier is specified, it displays user registers (or the currently 788saved registers) instead of the kernel's. 789Note: The 790.Cm /u 791modifier is not supported on every machine, in which case 792incorrect information may be displayed. 793.\" -------------------- 794.It Ic show route Ar addr 795Prints the 796.Vt struct rtentry 797at 798.Ar addr . 799.\" -------------------- 800.It Ic show socket Ar addr 801Prints the 802.Vt struct socket 803at 804.Ar addr . 805If the socket is spliced, the 806.Vt struct sosplice 807associated with the socket is printed as well. 808.\" -------------------- 809.It Xo 810.Ic show struct 811.Ar name 812.Op addr 813.Xc 814Prints the content of the memory at 815.Ar addr 816as a struct 817.Ar name . 818Nested structures and bit fields are not printed. 819Character arrays are printed as bytes. 820.\" -------------------- 821.It Ic show swap 822Prints a detailed list of all swaps. 823.\" -------------------- 824.It Xo 825.Ic show tdb 826.Op Cm /f 827.Ar addr 828.Xc 829Prints the 830.Vt struct tdb 831at 832.Ar addr . 833If the 834.Cm /f 835modifier is specified, prints out all fields of this IPsec SA. 836.\" -------------------- 837.It Ic show uvmexp 838Displays a selection of uvm counters and statistics. 839.\" -------------------- 840.It Xo 841.Ic show vnode 842.Op Cm /f 843.Ar addr 844.Xc 845Prints the 846.Vt struct vnode 847at 848.Ar addr . 849If the 850.Cm /f 851modifier is specified, prints out all 852.Li bufs 853(see also 854.Cm show buf ) 855currently attached to this 856.Li vnode . 857.\" -------------------- 858.It Ic show watches 859Displays all watchpoints set with the 860.Ic watch 861command. 862.\" -------------------- 863.It Ic show witness Op Cm /b 864Prints the current order list. 865If the 866.Cm /b 867modifier is specified, the list of found lock order violations is printed 868instead. 869The 870.Cm option WITNESS 871is required for this command to be available. 872.\" -------------------- 873.It Ic show all procs Op Cm /anow 874Display information on all processes. 875.Pp 876.Bl -tag -width foo -compact 877.It Cm /n 878(Default) Show process information in a 879.Xr ps 1 Ns \&-like 880format. 881Information printed includes process ID, thread ID, parent 882process ID, UID, process status, process flags, process 883wait channel message and process command name. 884.It Cm /a 885Shows the kernel virtual addresses of each process' 886proc structure, u-area, and vmspace structure. 887The vmspace address is also the address of the process' 888.Li vm_map 889structure 890and can be used in the 891.Ic show map 892command. 893.It Cm /o 894Shows non-idle threads that were on CPU when ddb was entered. 895Information printed includes thread ID, process ID, UID, process flags, 896thread flags, current CPU, and command name. 897.It Cm /w 898Shows each thread's ID, command, process group, 899wait channel address, and wait channel message. 900.El 901.\" -------------------- 902.It Ic show all bufs Op Cm /f 903Display information about all buffers in the system. 904.Pp 905.Bl -tag -width foo -compact 906.It Cm /f 907For each buffer, print a more detailed output. 908See the 909.Ic show buf 910command for more information. 911.El 912.\" -------------------- 913.It Ic show all callout 914Display the contents of the callout table. 915.\" -------------------- 916.It Ic show all pools Op Cm /a 917Display information about all system pools in a format similar to 918.Xr vmstat 8 . 919.Pp 920.Bl -tag -width foo -compact 921.It Cm /a 922Displays 923.Dq interesting 924address information. 925.El 926.\" -------------------- 927.It Ic show all locks 928Prints the list of locks held by all threads in the system. 929The 930.Cm option WITNESS 931is required for this command to be available. 932.\" -------------------- 933.It Ic show all mounts Op Cm /f 934Display information on all mounted filesystems. 935.Pp 936.Bl -tag -width foo -compact 937.It Cm /f 938For each filesystem, list all its struct vnode addresses. 939These addresses can be used in the 940.Ic show vnode 941command. 942.El 943.\" -------------------- 944.It Ic show all nfsnodes Op Cm /f 945Display information about all nfsnodes in the system. 946.Pp 947.Bl -tag -width foo -compact 948.It Cm /f 949For each nfsnode, print a more detailed output. 950See the 951.Ic show nfsnode 952command for more information. 953.El 954.\" -------------------- 955.It Ic show all nfsreqs Op Cm /f 956Display information for all outstanding NFS requests. 957.Pp 958.Bl -tag -width foo -compact 959.It Cm /f 960For each NFS requests, print a more detailed output. 961See the 962.Ic show nfsreq 963command for more information. 964.El 965.\" -------------------- 966.It Xo 967.Ic show all routes 968.Op Cm /iI 969.Op Ar rtableid 970.Op Ic \&, Ns Ar count 971.Xc 972Show internet routing tables. 973Default for 974.Ar rtableid 975is 0 and 976.Ar count 977is 1. 978.Pp 979.Bl -tag -width foo -compact 980.It Cm /i 981Restrict to AF_INET. 982.It Cm /I 983Restrict to AF_INET6. 984.El 985.\" -------------------- 986.It Ic show all tdbs Op Cm /f 987Display information about all IPsec SAs in the system. 988.Pp 989.Bl -tag -width foo -compact 990.It Cm /f 991For each tdb, print a more detailed output. 992See the 993.Ic show tdb 994command for more information. 995.El 996.\" -------------------- 997.It Ic show all vnodes Op Cm /f 998Display information about all vnodes in the system. 999.Pp 1000.Bl -tag -width foo -compact 1001.It Cm /f 1002For each vnode, print a more detailed output. 1003See the 1004.Ic show vnode 1005command for more information. 1006.El 1007.El 1008.\" -------------------- 1009.It Ic callout 1010A synonym for the 1011.Ic show all callout 1012command. 1013.\" -------------------- 1014.It Ic ps Op Cm /anow 1015A synonym for 1016.Ic show all procs . 1017.\" -------------------- 1018.Tg machine 1019.It Xo 1020.Ic mac Ns Op Ic hine 1021.Ar subcommand Op Ar arg ... 1022.Xc 1023Perform a platform-specific command. 1024.Pp 1025The following commands are supported by multiprocessor kernels on 1026these platforms: amd64, i386, macppc, mips64, and sparc64. 1027.Pp 1028.Bl -tag -width "searchframe [addr]" -compact 1029.It Ic cpuinfo 1030Display the state of each CPU. 1031.It Ic ddbcpu Ar N 1032Stop the current CPU and start handling 1033.Nm 1034on the selected CPU. 1035.It Ic startcpu Op Ar N 1036Resume normal processing on the selected CPU, 1037or all CPUs if none is specified. 1038.It Ic stopcpu Op Ar N 1039Stop normal processing on the selected CPU, 1040or all CPUs (except the one handling 1041.Nm ) 1042if none is specified. 1043.El 1044.Pp 1045Other platform-specific commands: 1046.\" .Pp 1047.\" amd64: 1048.Pp 1049arm: 1050.Bl -tag -width "searchframe [addr]" -compact 1051.It Ic frame Ar addr 1052Display the trapframe at 1053.Ar addr . 1054.El 1055.Pp 1056i386: 1057.Bl -tag -width "searchframe [addr]" -compact 1058.\" .It Ic acpi disasm Ar ?? 1059.\" .It Ic acpi showval Ar ?? 1060.\" .It Ic acpi tree Ar ?? 1061.\" .It Ic acpi trace Ar ?? 1062.\" Evil ACPI debugging magic. 1063.It Ic sysregs 1064Display the contents of the privileged registers: 1065.Va IDTR , 1066.Va GDTR , 1067.Va LDTR , 1068.Va TR , 1069.Va CR0 , 1070.Va CR2 , 1071.Va CR3 , 1072and 1073.Va CR4 . 1074.\" (i386-only) 1075.El 1076.Pp 1077m88k: 1078.Bl -tag -width "searchframe [addr]" -compact 1079.It Ic ddbcpu Ar N 1080Stop the current CPU and start handling 1081.Nm 1082on the selected CPU. 1083.It Ic frame Ar addr 1084Display the trapframe at 1085.Ar addr . 1086.It Ic regs 1087Display the registers from when 1088.Nm 1089was entered. 1090.It Ic searchframe Op Ar addr 1091Search for and display stack exception frames, 1092starting from 1093.Ar addr 1094if given, else the address in register 1095.Va r31 , 1096and stopping at the next 8k boundary. 1097.It Ic where 1098Display where the current CPU was stopped. 1099.El 1100.Pp 1101mips64: 1102.Bl -tag -width "searchframe [addr]" -compact 1103.It Xo 1104.Ic tlb Op Cm /p Ar asid 1105.Op Cm /c 1106.Op Ar tlb 1107.Xc 1108.It Ic trap Ar ?? 1109.El 1110.Pp 1111sh: 1112.Bl -tag -width "searchframe [addr]" -compact 1113.It Ic cache Op Ar addr 1114Display the cache, starting from 1115.Ar addr , 1116defaulting to 0. 1117.It Ic frame 1118Display the switch and trap frames. 1119.\" .It Ic stack 1120.It Ic tlb 1121Display the TLB. 1122.El 1123.Pp 1124sparc64: 1125.Bl -tag -width "searchframe [addr]" -compact 1126.It Ic ctx 1127Display the context addresses for all threads. 1128.\" .It Ic dtlb Ar 0,2 1129.\" .It Ic dtsb 1130.\" .It Ic esp 1131.\" .It Ic fpstate Op Ar addr 1132.\" .It Ic itlb Ar 0,1,2 1133.\" .It Ic kmap Op Ar addr 1134.\" .It Ic pcb Op Ar addr 1135.\" .It Ic pctx Ar pid 1136.\" .It Ic page Ar addr 1137.\" .It Ic phys Op Ar addr 1138.\" .It Ic pmap Op Ar addr 1139.\" .It Ic proc Op Ar addr 1140.\" .It Ic prom Ar ?? 1141.\" .It Ic pv Ar addr 1142.\" .It Ic stack Op Ar addr 1143.\" .It Ic tf Op Ar addr 1144.\" .It Ic ts 1145.\" .It Ic traptrace Op Ar addr 1146.\" .It Ic watch Op Ar addr 1147.\" .It Ic window Op Ar winnum 1148.\" .It Ic xir Op Ar addr 1149.El 1150.\" -------------------- 1151.El 1152.Sh VARIABLES 1153.Nm 1154denotes registers and variables by 1155.Ic $ Ns Va name . 1156Register names can be found with the 1157.Ic show registers 1158command. 1159.Pp 1160Some variable names are suffixed with numbers, and some may have a modifier 1161following a colon immediately after the variable name. 1162For example, register variables can have the 1163.Ql :u 1164modifier to indicate a 1165user register (e.g., 1166.Ql $eax:u ) . 1167.Pp 1168Built-in debugger variables currently supported are: 1169.Bl -tag -width 10n -compact -offset indent 1170.It Va $radix 1171Input and output radix. 1172.It Va $maxoff 1173Addresses are printed as 1174.Ar symbol Ns Li + Ns Ar offset 1175unless 1176.Ar offset 1177is greater than 1178.Va $maxoff . 1179.It Va $maxwidth 1180The width of the displayed lines. 1181.It Va $lines 1182The number of lines to page. 1183This is used by the 1184.Dq more 1185feature. 1186.It Va $tabstops 1187Tab stop width. 1188.It Va $log 1189Controls whether the output of 1190.Nm 1191will also appear in the system message 1192buffer. 1193.El 1194.Pp 1195These variables can also be controlled outside 1196.Nm 1197via the 1198.Sq ddb 1199.Xr sysctl 8 1200hierarchy. 1201.Sh EXPRESSIONS 1202Almost all expression operators in C are supported except for 1203.Ql ~ , 1204.Ql ^ , 1205and unary 1206.Ql & . 1207Special rules for expressions in 1208.Nm 1209are: 1210.Bl -tag -width 15n -compact -offset indent 1211.It Ar identifier 1212The name of a symbol. 1213It is translated to the address (or value) of the symbol. 1214.Ql \&. 1215and 1216.Ql \&: 1217can be used in the identifier. 1218The following can be accepted as an identifier, 1219if supported by an object format dependent routine: 1220.Bl -item -offset indent -compact 1221.It 1222.Sm off 1223.Oo Ar filename Li \&: Oc Ar func 1224.Op \&: Ar linenumber 1225.It 1226.Op Ar filename \&: 1227.Ar variable 1228.It 1229.Ar filename 1230.Op \&: Ar linenumber 1231.Sm on 1232.El 1233The symbol may be prefixed with 1234.Sq Ar symboltablename Ns :: 1235(e.g., 1236.Ql emulator::mach_msg_trap ) 1237to specify other than kernel symbols. 1238.It Ar number 1239The radix is determined by the first two letters: 1240.Ql 0x : 1241hex, 1242.Ql 0o : 1243octal, 1244.Ql 0t : 1245decimal, otherwise, the value of 1246.Va $radix 1247is used. 1248.It Li \&. 1249.Va dot : 1250the current address. 1251.It Li + 1252.Va next : 1253the next address. 1254.It Li .. 1255The address of the start of the last line examined. 1256Unlike 1257.Va dot 1258or 1259.Va next , 1260this is only changed by the 1261.Ic examine 1262or 1263.Ic write 1264command. 1265.It Li ' 1266The last address explicitly specified. 1267.It Li $ Ns Ar variable 1268The value of a register or variable. 1269The name may be followed by a 1270.Ql \&: 1271and modifiers as described above with 1272.Ar identifier . 1273.It Ar expr Li # Ar expr 1274A binary operator which rounds up the left hand side to the next 1275multiple of right hand side. 1276.It Li * Ns Ar expr 1277Indirection. 1278It may be followed by a ':' and modifiers as described above. 1279.El 1280.Sh SEE ALSO 1281.Xr ctfstrip 1 , 1282.Xr gdb 1 , 1283.Xr nm 1 , 1284.Xr witness 4 , 1285.Xr sysctl.conf 5 , 1286.Xr hangman 6 , 1287.Xr crash 8 , 1288.Xr sysctl 8 , 1289.Xr extent 9 , 1290.Xr pool 9 , 1291.Xr uvm_init 9 1292.Sh HISTORY 1293This kernel facility first appeared in the MACH 2 operating system 1294developed by CMU. 1295Hangman (which stands for "hangs maniacal analyzer") first appeared in 1296.Ox 1.2 . 1297