1.\" $OpenBSD: ddb.4,v 1.101 2022/03/31 17:27:20 naddy Exp $ 2.\" $NetBSD: ddb.4,v 1.5 1994/11/30 16:22:09 jtc Exp $ 3.\" 4.\" Mach Operating System 5.\" Copyright (c) 1991,1990 Carnegie Mellon University 6.\" All Rights Reserved. 7.\" 8.\" Permission to use, copy, modify and distribute this software and its 9.\" documentation is hereby granted, provided that both the copyright 10.\" notice and this permission notice appear in all copies of the 11.\" software, derivative works or modified versions, and any portions 12.\" thereof, and that both notices appear in supporting documentation. 13.\" 14.\" CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS" 15.\" CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR 16.\" ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE. 17.\" 18.\" Carnegie Mellon requests users of this software to return to 19.\" 20.\" Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU 21.\" School of Computer Science 22.\" Carnegie Mellon University 23.\" Pittsburgh PA 15213-3890 24.\" 25.\" any improvements or extensions that they make and grant Carnegie Mellon 26.\" the rights to redistribute these changes. 27.\" 28.Dd $Mdocdate: March 31 2022 $ 29.Dt DDB 4 30.Os 31.Sh NAME 32.Nm ddb 33.Nd kernel debugger 34.Sh DESCRIPTION 35The 36.Nm 37debugger provides a means for debugging the kernel, 38and analysing the kernel after a system crash ("panic"), with a 39.Xr gdb 1 Ns \&-like 40syntax. 41.Pp 42.Nm 43is invoked upon a kernel panic when the 44.Xr sysctl 8 45.Va ddb.panic 46is set to 1. 47It may be invoked from the console when the sysctl 48.Va ddb.console 49is set to 1, using any of the following methods: 50.Bl -dash -offset 3n 51.It 52Using the key sequence 53.Li Ctrl-Alt-Esc . 54.It 55Sending a 56.Dv BREAK 57when using a serial console. 58.It 59Writing to the sysctl 60.Va ddb.trigger . 61.It 62For i386 and amd64 architectures, 63using the key sequence 64.Li Ctrl-Alt-Delete 65when the sysctl 66.Va machdep.kbdreset 67is set to 2. 68.El 69.Pp 70.Nm 71prompts for commands on the console with: 72.Pp 73.Dl ddb> 74.Pp 75The general syntax of a 76.Nm 77command is: 78.Bd -ragged -offset indent 79.Ar command 80.Oo Ic / Ns Ar modifiers Oc " " 81.Oo Ar address Oc Ns 82.Op Ic \&, Ns Ar count 83.Ed 84.Pp 85To save typing, 86.Nm 87makes use of a context inferred from previous commands. 88In this context, 89the current location is called 90.Va dot . 91.\" The 92.\" .Va dot 93.\" is displayed with 94.\" a hexadecimal format at a prompt. 95The 96.Ic examine , 97.Ic search , 98.Ic show struct , 99and 100.Ic write 101commands update 102.Va dot 103to be that of the last address 104examined or the last location modified, and 105have intuitive effects on 106.Va next 107and 108.Va prev . 109All the other commands do not change 110.Va dot , 111and set 112.Va next 113to be the same. 114(See 115.Sx VARIABLES . ) 116.Pp 117.\" Specifying 118.\" .Ar address 119.\" in a command sets 120.\" .Va dot . 121An expression can be used in place of 122.Ar address 123(see 124.Sx EXPRESSIONS ) . 125Omitting 126.Ar address 127in a command uses the last value of 128.Va dot . 129A missing 130.Ar count 131is taken to be 1 for printing commands or \*(If 132for stack traces. 133Entering a blank line causes the last command to be repeated using 134.Va next 135in place of 136.Ar address , 137a 138.Ar count 139of 1, and no modifiers. 140.Pp 141.Nm 142has a feature like 143.Xr more 1 144for the output. 145If the number of lines output in response to one command exceeds the number 146set in the 147.Va $lines 148variable, it displays the message 149.Ql "--db_more--" 150and waits for a response. 151.Pp 152The valid responses are: 153.Pp 154.Bl -tag -width 10n -offset indent -compact 155.It Aq Ic space 156One more page. 157.It Aq Ic return 158One more line. 159.It Ic q 160Abort the current command, and return to the command input mode. 161.El 162.Pp 163The following command line editing keys are provided: 164.Pp 165.Bl -tag -width 10n -offset indent -compact 166.It Ic ^b 167back one character 168.It Ic ^f 169forward one character 170.It Ic ^a 171beginning of line 172.It Ic ^e 173end of line 174.It Ic ^w 175erase word back 176.It Ic ^h | Aq Ic del 177erase previous character 178.It Ic ^d 179erase next character 180.It Ic ^k 181delete to end of line 182.It Ic ^u 183delete line 184.It Ic ^p 185previous in command history 186.It Ic ^n 187next in command history 188.It Ic ^r 189redraw line 190.It Ic ^t 191exchange the two characters to the left of the cursor 192.El 193.Sh COMMANDS 194The following commands may be typed at the 195.Ql ddb> 196prompt. 197Some commands consist of more than one word, and if only the first word 198or words are entered, the possible alternatives to complete the command 199are displayed and no other action is performed. 200.Bl -tag -width 10n 201.\" -------------------- 202.It Ic help 203List the available commands. 204.\" -------------------- 205.Tg examine 206.It Xo 207.Oo Ic e Oc Ns 208.Ic x Ns Op Ic amine 209.Op Cm /bhlqaAxzodurcsmiI 210.Op Ar addr Ns 211.Op Ic \&, Ns Ar count 212.Xc 213Display the contents at address 214.Ar addr 215according to the formats in the modifier. 216If no format is specified, the last formats specified for this command 217are used. 218.Pp 219The format characters are: 220.Pp 221.Bl -tag -width 4n -compact 222.It Cm /b 223look at by bytes (8 bits) 224.It Cm /h 225look at by half words (16 bits) 226.It Cm /l 227look at by long words (32 bits) (default) 228.It Cm /q 229look at by long longs (64 bits) (only available on 64-bit platforms) 230.It Cm /a 231print the location being displayed 232.It Cm /A 233print the location with a line number if possible 234.It Cm /x 235display in unsigned hex 236.It Cm /z 237display in signed hex 238.It Cm /o 239display in unsigned octal 240.It Cm /d 241display in signed decimal 242.It Cm /u 243display in unsigned decimal 244.It Cm /r 245display in current radix, signed 246.It Cm /c 247display low 8 bits as a character. 248Non-printing characters are displayed as an octal escape code (e.g., '\e000'). 249.It Cm /s 250display the null-terminated string at the location. 251Non-printing characters are displayed as octal escapes. 252.It Cm /m 253display in unsigned hex with character dump at the end of each line. 254The location is also displayed in hex at the beginning of each line. 255.It Cm /i 256display as an instruction 257.It Cm /I 258display as an alternate format instruction depending on the 259machine: 260.Pp 261.Bl -tag -width powerpc_ -compact 262.It alpha 263Print affected register contents for every instruction. 264.It amd64 , 265.It i386 266Do not skip padding to the next long word boundary for unconditional jumps. 267.It m88k 268Decode instructions for the opposite CPU model (e.g. m88110 when running on an 269m88100 processor). 270.El 271.El 272.Pp 273The value of 274.Va next 275is set to the 276.Ar addr 277plus the size of the data examined. 278.\" -------------------- 279.Tg print 280.It Xo 281.Ic p Ns Op Ic rint 282.Op Cm /axzodurc 283.Op Ar addr 284.Xc 285Print 286.Ar addr 287according to the modifier character. 288The valid modifiers are a subset of those from the 289.Ic examine 290command, and act as described there. 291If no modifier is specified, the last one specified in a 292previous use of 293.Ic print 294is used. 295.Pp 296For example, 297.Bd -literal -offset indent 298print/x $eax 299.Ed 300.Pp 301will print something like this: 302.Bd -literal -offset indent 303xxxxxx 304.Ed 305.\" -------------------- 306.Tg pprint 307.It Xo 308.Ic pp Ns Op Ic rint 309.Op Ar addr 310.Xc 311Pretty-print 312.Ar addr 313using CTF debug symbols included in the kernel binary image. 314The CTF section is normally added by running 315.Xr ctfstrip 1 316as part of building a new kernel. 317.\" -------------------- 318.\" .It Xo Ic w Ns Op Cm /bhl 319.\" .Op Ar addr 320.\" .Ar expr Op expr ... 321.\" .Xc 322.Tg write 323.It Xo 324.Ic w Ns Op Ic rite 325.Op Cm /bhl 326.Op Ar addr 327.Ar expr Op Ar expr ... 328.Xc 329Write the value of each 330.Ar expr 331expression at succeeding locations start at 332.Ar addr . 333The write unit size can be specified using one of the modifiers: 334.Pp 335.Bl -tag -width 4n -offset indent -compact 336.It Cm /b 337byte (8 bits) 338.It Cm /h 339half word (16 bits) 340.It Cm /l 341long word (32 bits) (default) 342.El 343.Pp 344The value of 345.Va next 346is set to 347.Ar addr 348plus the size of values written. 349.Pp 350.Sy Warning : 351since there is no delimiter between expressions, the 352command may not parse as you expect. 353It is best to enclose each expression in parentheses. 354.\" -------------------- 355.It Xo Ic set 356.Ic $ Ns Ar name 357.Op Ic = 358.Ar expr 359.Xc 360Set the named variable or register with the value of 361.Ar expr . 362For valid variable names, 363see 364.Sx VARIABLES . 365.\" -------------------- 366.It Ic boot Ar how 367Reboot the machine depending on 368.Ar how : 369.Pp 370.Bl -tag -width "boot poweroff" -compact 371.It Ic boot sync 372Sync disks and reboot. 373.It Ic boot crash 374Dump core and reboot. 375.It Ic boot dump 376Sync disks, dump core and reboot. 377.It Ic boot halt 378Just halt. 379.It Ic boot reboot 380Just reboot. 381.It Ic boot poweroff 382Power down the machine whenever possible; if it fails, just halt. 383.El 384.\" -------------------- 385.It Xo 386.Ic break 387.Op Ar addr Ns 388.Op Ic \&, Ns Ar count 389.Xc 390Set a break point at 391.Ar addr . 392If 393.Ar count 394is supplied, 395.Nm 396allows the breakpoint to be silently hit 397.Ar ( count No \- 1 ) 398times before stopping at the 399break point. 400.\" -------------------- 401.Tg delete 402.It Xo 403.Ic d Ns Op Ic elete 404.Op Ar addr 405.Xc 406Delete the break point set with the 407.Ic break 408command. 409.\" -------------------- 410.\" .It Xo Ic s Ns Op Cm /p 411.\" .Op Ic \&, Ns Ar count 412.\" .Xc 413.Tg step 414.It Xo 415.Ic s Ns Op Ic tep 416.Op Cm /p 417.Op Ic \&, Ns Ar count 418.Xc 419Single step 420.Ar count 421times. 422If the 423.Cm /p 424modifier is specified, print each instruction at each step. 425Otherwise, only print the last instruction. 426.Pp 427.Sy Warning : 428depending on machine type, it may not be possible to 429single-step through some low-level code paths. 430On machines with software-emulated single-stepping (e.g., alpha), 431stepping through code executed by interrupt handlers will probably 432do the wrong thing. 433.\" -------------------- 434.It Ic call Ar name Ns Xo 435.Ic \&( Ns Ar expr 436.Op Ic \&, Ar expr ... 437.Ic \&) 438.Xc 439Call the function named by 440.Ar name 441with the argument(s) listed in parentheses. 442Parentheses may be omitted if the function takes no arguments. 443The number of arguments is currently limited to 10. 444.\" -------------------- 445.\" .It Ic c Ns Op Cm /c 446.Tg continue 447.It Xo 448.Ic c Ns Op Ic ontinue 449.Op Cm /c 450.Xc 451Continue execution until a breakpoint or watchpoint. 452If the 453.Cm /c 454modifier is given, instructions are counted while executing. 455.Pp 456.Sy Warning : 457when counting with 458.Cm /c , 459.Nm 460is really silently single-stepping. 461This means that single-stepping on low-level code may cause strange 462behavior. 463.\" -------------------- 464.It Xo 465.Ic watch 466.Ar addr 467.Op Ic \&, Ns Ar size 468.Xc 469Set a watchpoint for the region starting at 470.Ar addr . 471Execution stops and control returns to 472.Nm 473when an attempt is made to modify a watched region. 474The 475.Ar size 476argument defaults to 4. 477.Pp 478If you specify a wrong space address, the request is rejected 479with an error message. 480.Pp 481.Sy Warning : 482attempts to watch wired kernel memory 483may cause an unrecoverable error on some systems (e.g., i386). 484.\" -------------------- 485.It Ic dwatch Ar addr 486Delete the watchpoint at address 487.Ar addr 488that was previously set with a 489.Ic watch 490command. 491.\" -------------------- 492.It Xo 493.Ic hangman 494.Op Cm /s Ns Op Ic 0-9 495.Xc 496This is a tiny and handy tool for random kernel hangs analysis, of which its 497depth is controlled by the optional argument of the default value of five. 498It uses some sophisticated heuristics to spot the global symbol that 499caused the hang. 500Since the discovering algorithm is a probabilistic one, 501you may spend substantial time to figure the exact symbol name. 502This smart thing requires a little of your attention, the input it accepts 503is mostly of the same format as that of the famous 504.Xr hangman 6 505game, to which it, apparently, is obliged by the name. 506Hint: the 507.Xr nm 1 508utility might help. 509.\" -------------------- 510.It Ic until Op Cm /p 511Stop at the next 512.Qq call 513or 514.Qq return 515instruction. 516If the 517.Cm /p 518modifier is specified, 519.Nm 520prints the call nesting depth and the 521cumulative instruction count at each call or return. 522Otherwise, it stays silent until the matching return is hit. 523.\" -------------------- 524.It Ic match Op Cm /p 525Stop at the next matching return instruction. 526If the 527.Cm /p 528modifier is specified, 529.Nm 530prints the call nesting depth and the 531cumulative instruction count at each call or return. 532Otherwise, it remains mostly quiet. 533.\" -------------------- 534.It Ic next Op Cm /p 535The 536.Ic next 537command is a synonym for 538.Ic match . 539.\" -------------------- 540.It Ic kill Ar pid 541Send an uncatchable 542.Dv SIGABRT 543signal to the process specified by the 544.Ar pid 545argument. 546.\" -------------------- 547.It Xo 548.Ic trace 549.Op Cm /tu 550.Op Ar frameaddr Ns 551.Op Ic \&, Ns Ar count 552.Xc 553Show the stack trace. 554The 555.Cm /t 556modifier interprets the 557.Ar frameaddr 558argument as the TID of a process and shows the stack trace of 559that process. 560.Ar frameaddr 561is subject to the radix; use the 0t prefix to enter a decimal TID. 562The 563.Cm /t 564modifier is not supported on all platforms. 565The 566.Cm /u 567modifier shows the stack trace of user space; 568if omitted, the kernel stack is traced instead. 569The 570.Ar count 571argument is the limit on the number of frames to be followed. 572If 573.Ar count 574is omitted, all frames are printed. 575.Pp 576.Sy Warning : 577user space stack trace is valid 578only if the machine dependent code supports it. 579.\" -------------------- 580.It Xo 581.Ic search 582.Op Cm /bhl 583.Op Ar addr 584.Ar value 585.Op Ar mask 586.Op Ic \&, Ns Ar count 587.Xc 588Search memory for a value beginning at 589.Ar addr . 590This command might fail in interesting 591ways if it doesn't find the searched-for value. 592This is because 593.Nm 594doesn't always recover from touching bad memory. 595The optional 596.Ar count 597argument limits the search. 598The modifiers are the same as those of the 599.Ic write 600command. 601.Pp 602The 603.Va next 604address is set to the address where 605.Ar value 606is found, or just after where the search area finishes. 607.\" -------------------- 608.It Ic reboot 609Shortcut for 610.Ic boot reboot 611.\" -------------------- 612.It Ic show Ar what 613Displays various things, depending on 614.Ar what : 615.Bl -tag -width 4n 616.\" -------------------- 617.It Ic show bcstats 618Prints the buffer cache statistics. 619.\" -------------------- 620.It Ic show breaks 621Prints a list of all breakpoints that have been set with the 622.Ic break 623command. 624.\" -------------------- 625.It Xo 626.Ic show buf 627.Op Cm /f 628.Ar addr 629.Xc 630Prints the 631.Li struct buf 632at 633.Ar addr . 634If the 635.Cm /f 636modifier is specified output will also include 637.Li softdep 638printout, if those are available. 639.\" -------------------- 640.It Ic show extents 641Prints a detailed list of all extents. 642.\" -------------------- 643.It Ic show locks Op Ar addr 644Prints the list of locks held by a thread. 645If an optional address is not specified, 646.Li curproc 647is assumed. 648The 649.Cm option WITNESS 650is required for this command to be available. 651.\" -------------------- 652.It Ic show malloc Op Ar addr 653Prints malloc debugging information if available. 654If an optional address is specified, only information about that address 655is printed. 656.\" -------------------- 657.It Xo 658.Ic show map 659.Op Cm /f 660.Ar addr 661.Xc 662Prints the 663.Li vm_map 664at 665.Ar addr . 666If the 667.Cm /f 668modifier is specified, the complete map is printed. 669.\" -------------------- 670.It Ic show mbuf Ar addr 671Prints the 672.Li struct mbuf 673header at 674.Ar addr . 675Depending on the mbuf flags 676.Li struct pkthdr 677and 678.Li struct m_ext 679are printed as well. 680.\" -------------------- 681.It Xo 682.Ic show mount 683.Op Cm /f 684.Ar addr 685.Xc 686Prints the 687.Li struct mount 688at 689.Ar addr . 690If the 691.Cm /f 692modifier is specified, prints out all 693.Li vnodes 694(see also 695.Cm show vnode ) 696and also all 697.Li bufs 698(see also 699.Cm show buf ) 700on all those vnodes. 701.\" -------------------- 702.It Xo 703.Ic show nfsnode 704.Op Cm /f 705.Ar addr 706.Xc 707Prints the 708.Li struct nfsnode 709at 710.Ar addr . 711If the 712.Cm /f 713modifier is specified, prints out additional 714information as well. 715.\" -------------------- 716.It Xo 717.Ic show nfsreq 718.Op Cm /f 719.Ar addr 720.Xc 721Prints the 722.Li struct nfsreq 723at 724.Ar addr . 725If the 726.Cm /f 727modifier is specified, prints out additional 728information as well. 729.\" -------------------- 730.It Xo 731.Ic show object 732.Op Cm /f 733.Ar addr 734.Xc 735Prints the 736.Li vm_object 737at 738.Ar addr . 739If the 740.Cm /f 741modifier is specified, the complete object is printed. 742.\" -------------------- 743.It Xo 744.Ic show page 745.Op Cm /f 746.Ar addr 747.Xc 748Prints the 749.Li vm_page 750at 751.Ar addr . 752If the 753.Cm /f 754modifier is specified, the complete page is printed. 755.\" -------------------- 756.It Ic show panic 757Prints the panic string. 758.\" -------------------- 759.It Xo 760.Ic show pool 761.Op Cm /p 762.Ar addr 763.Xc 764Prints the 765.Li pool 766at 767.Ar addr . 768Valid modifiers: 769.Bl -tag -width xxx -compact 770.It Cm /p 771Print the pagelist for this pool. 772.El 773.\" -------------------- 774.It Ic show proc Op Ar addr 775Prints the 776.Li struct proc 777at 778.Ar addr . 779If an optional address is not specified, 780.Li curproc 781is assumed. 782.\" -------------------- 783.It Ic show registers Op Cm /u 784Display the register set. 785If the 786.Cm /u 787modifier is specified, it displays user registers (or the currently 788saved registers) instead of the kernel's. 789Note: The 790.Cm /u 791modifier is not supported on every machine, in which case 792incorrect information may be displayed. 793.\" -------------------- 794.It Ic show socket Ar addr 795Prints the 796.Li struct socket 797at 798.Ar addr . 799If the socket is spliced, the 800.Li struct sosplice 801associated with the socket is printed as well. 802.\" -------------------- 803.It Xo 804.Ic show struct 805.Ar name 806.Op addr 807.Xc 808Prints the content of the memory at 809.Ar addr 810as a struct 811.Ar name . 812Nested structures and bit fields are not printed. 813Character arrays are printed as bytes. 814.\" -------------------- 815.It Xo 816.Ic show tdb 817.Op Cm /f 818.Ar addr 819.Xc 820Prints the 821.Li struct tdb 822at 823.Ar addr . 824If the 825.Cm /f 826modifier is specified, prints out all fields of this IPsec SA. 827.\" -------------------- 828.It Ic show uvmexp 829Displays a selection of uvm counters and statistics. 830.\" -------------------- 831.It Xo 832.Ic show vnode 833.Op Cm /f 834.Ar addr 835.Xc 836Prints the 837.Li struct vnode 838at 839.Ar addr . 840If the 841.Cm /f 842modifier is specified, prints out all 843.Li bufs 844(see also 845.Cm show buf ) 846currently attached to this 847.Li vnode . 848.\" -------------------- 849.It Ic show watches 850Displays all watchpoints set with the 851.Ic watch 852command. 853.\" -------------------- 854.It Ic show witness Op Cm /b 855Prints the current order list. 856If the 857.Cm /b 858modifier is specified, the list of found lock order violations is printed 859instead. 860The 861.Cm option WITNESS 862is required for this command to be available. 863.\" -------------------- 864.It Ic show all procs Op Cm /anow 865Display information on all processes. 866.Pp 867.Bl -tag -width foo -compact 868.It Cm /n 869(Default) Show process information in a 870.Xr ps 1 Ns \&-like 871format. 872Information printed includes process ID, thread ID, parent 873process ID, UID, process status, process flags, process 874wait channel message and process command name. 875.It Cm /a 876Shows the kernel virtual addresses of each process' 877proc structure, u-area, and vmspace structure. 878The vmspace address is also the address of the process' 879.Li vm_map 880structure 881and can be used in the 882.Ic show map 883command. 884.It Cm /o 885Shows non-idle threads that were on CPU when ddb was entered. 886Information printed includes thread ID, process ID, UID, process flags, 887thread flags, current CPU, and command name. 888.It Cm /w 889Shows each thread's ID, command, process group, 890wait channel address, and wait channel message. 891.El 892.\" -------------------- 893.It Ic show all bufs Op Cm /f 894Display information about all buffers in the system. 895.Pp 896.Bl -tag -width foo -compact 897.It Cm /f 898For each buffer, print a more detailed output. 899See the 900.Ic show buf 901command for more information. 902.El 903.\" -------------------- 904.It Ic show all callout 905Display the contents of the callout table. 906.\" -------------------- 907.It Ic show all pools Op Cm /a 908Display information about all system pools in a format similar to 909.Xr vmstat 8 . 910.Pp 911.Bl -tag -width foo -compact 912.It Cm /a 913Displays 914.Dq interesting 915address information. 916.El 917.\" -------------------- 918.It Ic show all locks 919Prints the list of locks held by all threads in the system. 920The 921.Cm option WITNESS 922is required for this command to be available. 923.\" -------------------- 924.It Ic show all mounts Op Cm /f 925Display information on all mounted filesystems. 926.Pp 927.Bl -tag -width foo -compact 928.It Cm /f 929For each filesystem, list all its struct vnode addresses. 930These addresses can be used in the 931.Ic show vnode 932command. 933.El 934.\" -------------------- 935.It Ic show all nfsnodes Op Cm /f 936Display information about all nfsnodes in the system. 937.Pp 938.Bl -tag -width foo -compact 939.It Cm /f 940For each nfsnode, print a more detailed output. 941See the 942.Ic show nfsnode 943command for more information. 944.El 945.\" -------------------- 946.It Ic show all nfsreqs Op Cm /f 947Display information for all outstanding NFS requests. 948.Pp 949.Bl -tag -width foo -compact 950.It Cm /f 951For each NFS requests, print a more detailed output. 952See the 953.Ic show nfsreq 954command for more information. 955.El 956.\" -------------------- 957.It Ic show all tdbs Op Cm /f 958Display information about all IPsec SAs in the system. 959.Pp 960.Bl -tag -width foo -compact 961.It Cm /f 962For each tdb, print a more detailed output. 963See the 964.Ic show tdb 965command for more information. 966.El 967.\" -------------------- 968.It Ic show all vnodes Op Cm /f 969Display information about all vnodes in the system. 970.Pp 971.Bl -tag -width foo -compact 972.It Cm /f 973For each vnode, print a more detailed output. 974See the 975.Ic show vnode 976command for more information. 977.El 978.El 979.\" -------------------- 980.It Ic callout 981A synonym for the 982.Ic show all callout 983command. 984.\" -------------------- 985.It Ic ps Op Cm /anow 986A synonym for 987.Ic show all procs . 988.\" -------------------- 989.Tg machine 990.It Xo 991.Ic mac Ns Op Ic hine 992.Ar subcommand Op Ar args ... 993.Xc 994Perform a platform-specific command. 995.Pp 996The following commands are supported by multiprocessor kernels on 997these platforms: amd64, i386, macppc, mips64, and sparc64. 998.Pp 999.Bl -tag -width "searchframe [addr]" -compact 1000.It Ic cpuinfo 1001Display the state of each CPU. 1002.It Ic ddbcpu Ar N 1003Stop the current CPU and start handling 1004.Nm 1005on the selected CPU. 1006.It Ic startcpu Op Ar N 1007Resume normal processing on the selected CPU, 1008or all CPUs if none is specified. 1009.It Ic stopcpu Op Ar N 1010Stop normal processing on the selected CPU, 1011or all CPUs (except the one handling 1012.Nm ) 1013if none is specified. 1014.El 1015.Pp 1016Other platform-specific commands: 1017.\" .Pp 1018.\" amd64: 1019.Pp 1020arm: 1021.Bl -tag -width "searchframe [addr]" -compact 1022.It Ic frame Ar addr 1023Display the trapframe at 1024.Ar addr . 1025.El 1026.Pp 1027i386: 1028.Bl -tag -width "searchframe [addr]" -compact 1029.\" .It Ic acpi disasm Ar ?? 1030.\" .It Ic acpi showval Ar ?? 1031.\" .It Ic acpi tree Ar ?? 1032.\" .It Ic acpi trace Ar ?? 1033.\" Evil ACPI debugging magic. 1034.It Ic sysregs 1035Display the contents of the privileged registers: 1036.Va IDTR , 1037.Va GDTR , 1038.Va LDTR , 1039.Va TR , 1040.Va CR0 , 1041.Va CR2 , 1042.Va CR3 , 1043and 1044.Va CR4 . 1045.\" (i386-only) 1046.El 1047.Pp 1048m88k: 1049.Bl -tag -width "searchframe [addr]" -compact 1050.It Ic ddbcpu Ar N 1051Stop the current CPU and start handling 1052.Nm 1053on the selected CPU. 1054.It Ic frame Ar addr 1055Display the trapframe at 1056.Ar addr . 1057.It Ic regs 1058Display the registers from when 1059.Nm 1060was entered. 1061.It Ic searchframe Op Ar addr 1062Search for and display stack exception frames, 1063starting from 1064.Ar addr 1065if given, else the address in register 1066.Va r31 , 1067and stopping at the next 8k boundary. 1068.It Ic where 1069Display where the current CPU was stopped. 1070.El 1071.Pp 1072mips64: 1073.Bl -tag -width "searchframe [addr]" -compact 1074.It Xo 1075.Ic tlb Op Cm /p Ar asid 1076.Op Cm /c 1077.Op Ar tlb 1078.Xc 1079.It Ic trap Ar ?? 1080.El 1081.Pp 1082sh: 1083.Bl -tag -width "searchframe [addr]" -compact 1084.It Ic cache Op Ar addr 1085Display the cache, starting from 1086.Ar addr , 1087defaulting to 0. 1088.It Ic frame 1089Display the switch and trap frames. 1090.\" .It Ic stack 1091.It Ic tlb 1092Display the TLB. 1093.El 1094.Pp 1095sparc64: 1096.Bl -tag -width "searchframe [addr]" -compact 1097.It Ic ctx 1098Display the context addresses for all threads. 1099.\" .It Ic dtlb Ar 0,2 1100.\" .It Ic dtsb 1101.\" .It Ic esp 1102.\" .It Ic fpstate Op Ar addr 1103.\" .It Ic itlb Ar 0,1,2 1104.\" .It Ic kmap Op Ar addr 1105.\" .It Ic pcb Op Ar addr 1106.\" .It Ic pctx Ar pid 1107.\" .It Ic page Ar addr 1108.\" .It Ic phys Op Ar addr 1109.\" .It Ic pmap Op Ar addr 1110.\" .It Ic proc Op Ar addr 1111.\" .It Ic prom Ar ?? 1112.\" .It Ic pv Ar addr 1113.\" .It Ic stack Op Ar addr 1114.\" .It Ic tf Op Ar addr 1115.\" .It Ic ts 1116.\" .It Ic traptrace Op Ar addr 1117.\" .It Ic watch Op Ar addr 1118.\" .It Ic window Op Ar winnum 1119.\" .It Ic xir Op Ar addr 1120.El 1121.\" -------------------- 1122.El 1123.Sh VARIABLES 1124.Nm 1125denotes registers and variables by 1126.Ic $ Ns Va name . 1127Register names can be found with the 1128.Ic show registers 1129command. 1130.Pp 1131Some variable names are suffixed with numbers, and some may have a modifier 1132following a colon immediately after the variable name. 1133For example, register variables can have the 1134.Ql :u 1135modifier to indicate a 1136user register (e.g., 1137.Ql $eax:u ) . 1138.Pp 1139Built-in debugger variables currently supported are: 1140.Bl -tag -width 10n -compact -offset indent 1141.It Va $radix 1142Input and output radix. 1143.It Va $maxoff 1144Addresses are printed as 1145.Ar symbol Ns Li + Ns Ar offset 1146unless 1147.Ar offset 1148is greater than 1149.Va $maxoff . 1150.It Va $maxwidth 1151The width of the displayed lines. 1152.It Va $lines 1153The number of lines to page. 1154This is used by the 1155.Dq more 1156feature. 1157.It Va $tabstops 1158Tab stop width. 1159.It Va $log 1160Controls whether the output of 1161.Nm 1162will also appear in the system message 1163buffer. 1164.El 1165.Pp 1166These variables can also be controlled outside 1167.Nm 1168via the 1169.Sq ddb 1170.Xr sysctl 8 1171hierarchy. 1172.Sh EXPRESSIONS 1173Almost all expression operators in C are supported except for 1174.Ql ~ , 1175.Ql ^ , 1176and unary 1177.Ql & . 1178Special rules for expressions in 1179.Nm 1180are: 1181.Bl -tag -width 15n -compact -offset indent 1182.It Ar identifier 1183The name of a symbol. 1184It is translated to the address (or value) of the symbol. 1185.Ql \&. 1186and 1187.Ql \&: 1188can be used in the identifier. 1189The following can be accepted as an identifier, 1190if supported by an object format dependent routine: 1191.Bl -item -offset indent -compact 1192.It 1193.Sm off 1194.Oo Ar filename Li \&: Oc Ar func 1195.Op \&: Ar linenumber 1196.It 1197.Op Ar filename \&: 1198.Ar variable 1199.It 1200.Ar filename 1201.Op \&: Ar linenumber 1202.Sm on 1203.El 1204The symbol may be prefixed with 1205.Sq Ar symboltablename Ns :: 1206(e.g., 1207.Ql emulator::mach_msg_trap ) 1208to specify other than kernel symbols. 1209.It Ar number 1210The radix is determined by the first two letters: 1211.Ql 0x : 1212hex, 1213.Ql 0o : 1214octal, 1215.Ql 0t : 1216decimal, otherwise, the value of 1217.Va $radix 1218is used. 1219.It Li \&. 1220.Va dot : 1221the current address. 1222.It Li + 1223.Va next : 1224the next address. 1225.It Li .. 1226The address of the start of the last line examined. 1227Unlike 1228.Va dot 1229or 1230.Va next , 1231this is only changed by the 1232.Ic examine 1233or 1234.Ic write 1235command. 1236.It Li ' 1237The last address explicitly specified. 1238.It Li $ Ns Ar variable 1239The value of a register or variable. 1240The name may be followed by a 1241.Ql \&: 1242and modifiers as described above with 1243.Ar identifier . 1244.It Ar expr Li # Ar expr 1245A binary operator which rounds up the left hand side to the next 1246multiple of right hand side. 1247.It Li * Ns Ar expr 1248Indirection. 1249It may be followed by a ':' and modifiers as described above. 1250.El 1251.Sh SEE ALSO 1252.Xr ctfstrip 1 , 1253.Xr gdb 1 , 1254.Xr nm 1 , 1255.Xr witness 4 , 1256.Xr sysctl.conf 5 , 1257.Xr hangman 6 , 1258.Xr crash 8 , 1259.Xr sysctl 8 , 1260.Xr extent 9 , 1261.Xr pool 9 , 1262.Xr uvm_init 9 1263.Sh HISTORY 1264This kernel facility first appeared in the MACH 2 operating system 1265developed by CMU. 1266Hangman (which stands for "hangs maniacal analyzer") first appeared in 1267.Ox 1.2 . 1268