1.\" $OpenBSD: ddb.4,v 1.106 2023/09/19 11:36:33 claudio Exp $ 2.\" $NetBSD: ddb.4,v 1.5 1994/11/30 16:22:09 jtc Exp $ 3.\" 4.\" Mach Operating System 5.\" Copyright (c) 1991,1990 Carnegie Mellon University 6.\" All Rights Reserved. 7.\" 8.\" Permission to use, copy, modify and distribute this software and its 9.\" documentation is hereby granted, provided that both the copyright 10.\" notice and this permission notice appear in all copies of the 11.\" software, derivative works or modified versions, and any portions 12.\" thereof, and that both notices appear in supporting documentation. 13.\" 14.\" CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS" 15.\" CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR 16.\" ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE. 17.\" 18.\" Carnegie Mellon requests users of this software to return to 19.\" 20.\" Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU 21.\" School of Computer Science 22.\" Carnegie Mellon University 23.\" Pittsburgh PA 15213-3890 24.\" 25.\" any improvements or extensions that they make and grant Carnegie Mellon 26.\" the rights to redistribute these changes. 27.\" 28.Dd $Mdocdate: September 19 2023 $ 29.Dt DDB 4 30.Os 31.Sh NAME 32.Nm ddb 33.Nd kernel debugger 34.Sh DESCRIPTION 35The 36.Nm 37debugger provides a means for debugging the kernel, 38and analysing the kernel after a system crash ("panic"), with a 39.Xr gdb 1 Ns \&-like 40syntax. 41.Pp 42.Nm 43is invoked upon a kernel panic when the 44.Xr sysctl 8 45.Va ddb.panic 46is set to 1. 47It may be invoked from the console when the sysctl 48.Va ddb.console 49is set to 1, using any of the following methods: 50.Bl -dash -offset 3n 51.It 52Using the key sequence 53.Li Ctrl-Alt-Esc . 54.It 55Sending a 56.Dv BREAK 57when using a serial console. 58.It 59Writing to the sysctl 60.Va ddb.trigger . 61.It 62For i386 and amd64 architectures, 63using the key sequence 64.Li Ctrl-Alt-Delete 65when the sysctl 66.Va machdep.kbdreset 67is set to 2. 68.El 69.Pp 70.Nm 71prompts for commands on the console with: 72.Pp 73.Dl ddb> 74.Pp 75The general syntax of a 76.Nm 77command is: 78.Bd -ragged -offset indent 79.Ar command 80.Oo Ic / Ns Ar modifiers Oc " " 81.Oo Ar address Oc Ns 82.Op Ic \&, Ns Ar count 83.Ed 84.Pp 85To save typing, 86.Nm 87makes use of a context inferred from previous commands. 88In this context, 89the current location is called 90.Va dot . 91.\" The 92.\" .Va dot 93.\" is displayed with 94.\" a hexadecimal format at a prompt. 95The 96.Ic examine , 97.Ic search , 98.Ic show struct , 99and 100.Ic write 101commands update 102.Va dot 103to be that of the last address 104examined or the last location modified, and 105have intuitive effects on 106.Va next 107and 108.Va prev . 109All the other commands do not change 110.Va dot , 111and set 112.Va next 113to be the same. 114(See 115.Sx VARIABLES . ) 116.Pp 117.\" Specifying 118.\" .Ar address 119.\" in a command sets 120.\" .Va dot . 121An expression can be used in place of 122.Ar address 123(see 124.Sx EXPRESSIONS ) . 125Omitting 126.Ar address 127in a command uses the last value of 128.Va dot . 129A missing 130.Ar count 131is taken to be 1 for printing commands or \*(If 132for stack traces. 133Entering a blank line causes the last command to be repeated using 134.Va next 135in place of 136.Ar address , 137a 138.Ar count 139of 1, and no modifiers. 140.Pp 141.Nm 142has a feature like 143.Xr more 1 144for the output. 145If the number of lines output in response to one command exceeds the number 146set in the 147.Va $lines 148variable, it displays the message 149.Ql "--db_more--" 150and waits for a response. 151.Pp 152The valid responses are: 153.Pp 154.Bl -tag -width 10n -offset indent -compact 155.It Aq Ic space 156One more page. 157.It Aq Ic return 158One more line. 159.It Ic q 160Abort the current command, and return to the command input mode. 161.El 162.Pp 163The following command line editing keys are provided: 164.Pp 165.Bl -tag -width 10n -offset indent -compact 166.It Ic ^b 167back one character 168.It Ic ^f 169forward one character 170.It Ic ^a 171beginning of line 172.It Ic ^e 173end of line 174.It Ic ^w 175erase word back 176.It Ic ^h | Aq Ic del 177erase previous character 178.It Ic ^d 179erase next character 180.It Ic ^k 181delete to end of line 182.It Ic ^u 183delete line 184.It Ic ^p 185previous in command history 186.It Ic ^n 187next in command history 188.It Ic ^r 189redraw line 190.It Ic ^t 191exchange the two characters to the left of the cursor 192.El 193.Sh COMMANDS 194The following commands may be typed at the 195.Ql ddb> 196prompt. 197Some commands consist of more than one word, and if only the first word 198or words are entered, the possible alternatives to complete the command 199are displayed and no other action is performed. 200.Bl -tag -width 10n 201.\" -------------------- 202.It Ic help 203List the available commands. 204.\" -------------------- 205.Tg examine 206.It Xo 207.Oo Ic e Oc Ns 208.Ic x Ns Op Ic amine 209.Op Cm /bhlqaAxzodurcsmiI 210.Op Ar addr Ns 211.Op Ic \&, Ns Ar count 212.Xc 213Display the contents at address 214.Ar addr 215according to the formats in the modifier. 216If no format is specified, the last formats specified for this command 217are used. 218.Pp 219The format characters are: 220.Pp 221.Bl -tag -width 4n -compact 222.It Cm /b 223look at by bytes (8 bits) 224.It Cm /h 225look at by half words (16 bits) 226.It Cm /l 227look at by long words (32 bits) (default) 228.It Cm /q 229look at by long longs (64 bits) (only available on 64-bit platforms) 230.It Cm /a 231print the location being displayed 232.It Cm /A 233print the location with a line number if possible 234.It Cm /x 235display in unsigned hex 236.It Cm /z 237display in signed hex 238.It Cm /o 239display in unsigned octal 240.It Cm /d 241display in signed decimal 242.It Cm /u 243display in unsigned decimal 244.It Cm /r 245display in current radix, signed 246.It Cm /c 247display low 8 bits as a character. 248Non-printing characters are displayed as an octal escape code (e.g., '\e000'). 249.It Cm /s 250display the null-terminated string at the location. 251Non-printing characters are displayed as octal escapes. 252.It Cm /m 253display in unsigned hex with character dump at the end of each line. 254The location is also displayed in hex at the beginning of each line. 255.It Cm /i 256display as an instruction 257.It Cm /I 258display as an alternate format instruction depending on the 259machine: 260.Pp 261.Bl -tag -width powerpc_ -compact 262.It alpha 263Print affected register contents for every instruction. 264.It amd64 , 265.It i386 266Do not skip padding to the next long word boundary for unconditional jumps. 267.It m88k 268Decode instructions for the opposite CPU model (e.g. m88110 when running on an 269m88100 processor). 270.El 271.El 272.Pp 273The value of 274.Va next 275is set to the 276.Ar addr 277plus the size of the data examined. 278.\" -------------------- 279.Tg print 280.It Xo 281.Ic p Ns Op Ic rint 282.Op Cm /axzodurc 283.Op Ar addr 284.Xc 285Print 286.Ar addr 287according to the modifier character. 288The valid modifiers are a subset of those from the 289.Ic examine 290command, and act as described there. 291If no modifier is specified, the last one specified in a 292previous use of 293.Ic print 294is used. 295.Pp 296For example, 297.Bd -literal -offset indent 298print/x $eax 299.Ed 300.Pp 301will print something like this: 302.Bd -literal -offset indent 303xxxxxx 304.Ed 305.\" -------------------- 306.Tg pprint 307.It Xo 308.Ic pp Ns Op Ic rint 309.Op Ar addr 310.Xc 311Pretty-print 312.Ar addr 313using CTF debug symbols included in the kernel binary image. 314The CTF section is normally added by running 315.Xr ctfstrip 1 316as part of building a new kernel. 317.\" -------------------- 318.\" .It Xo Ic w Ns Op Cm /bhl 319.\" .Op Ar addr 320.\" .Ar expr Op expr ... 321.\" .Xc 322.Tg write 323.It Xo 324.Ic w Ns Op Ic rite 325.Op Cm /bhl 326.Op Ar addr 327.Ar expr Op Ar expr ... 328.Xc 329Write the value of each 330.Ar expr 331expression at succeeding locations start at 332.Ar addr . 333The write unit size can be specified using one of the modifiers: 334.Pp 335.Bl -tag -width 4n -offset indent -compact 336.It Cm /b 337byte (8 bits) 338.It Cm /h 339half word (16 bits) 340.It Cm /l 341long word (32 bits) (default) 342.El 343.Pp 344The value of 345.Va next 346is set to 347.Ar addr 348plus the size of values written. 349.Pp 350.Sy Warning : 351since there is no delimiter between expressions, the 352command may not parse as you expect. 353It is best to enclose each expression in parentheses. 354.\" -------------------- 355.It Xo Ic set 356.Ic $ Ns Ar name 357.Op Ic = 358.Ar expr 359.Xc 360Set the named variable or register with the value of 361.Ar expr . 362For valid variable names, 363see 364.Sx VARIABLES . 365.\" -------------------- 366.It Ic boot Ar how 367Reboot the machine depending on 368.Ar how : 369.Pp 370.Bl -tag -width "boot poweroff" -compact 371.It Ic boot sync 372Sync disks and reboot. 373.It Ic boot crash 374Dump core and reboot. 375.It Ic boot dump 376Sync disks, dump core and reboot. 377.It Ic boot halt 378Just halt. 379.It Ic boot reboot 380Just reboot. 381.It Ic boot poweroff 382Power down the machine whenever possible; if it fails, just halt. 383.El 384.\" -------------------- 385.It Xo 386.Ic break 387.Op Ar addr Ns 388.Op Ic \&, Ns Ar count 389.Xc 390Set a break point at 391.Ar addr . 392If 393.Ar count 394is supplied, 395.Nm 396allows the breakpoint to be silently hit 397.Ar ( count No \- 1 ) 398times before stopping at the 399break point. 400.\" -------------------- 401.Tg delete 402.It Xo 403.Ic d Ns Op Ic elete 404.Op Ar addr 405.Xc 406Delete the break point set with the 407.Ic break 408command. 409.\" -------------------- 410.\" .It Xo Ic s Ns Op Cm /p 411.\" .Op Ic \&, Ns Ar count 412.\" .Xc 413.Tg step 414.It Xo 415.Ic s Ns Op Ic tep 416.Op Cm /p 417.Op Ic \&, Ns Ar count 418.Xc 419Single step 420.Ar count 421times. 422If the 423.Cm /p 424modifier is specified, print each instruction at each step. 425Otherwise, only print the last instruction. 426.Pp 427.Sy Warning : 428depending on machine type, it may not be possible to 429single-step through some low-level code paths. 430On machines with software-emulated single-stepping (e.g., alpha), 431stepping through code executed by interrupt handlers will probably 432do the wrong thing. 433.\" -------------------- 434.It Ic call Ar name Ns Xo 435.Ic \&( Ns Ar expr 436.Op Ic \&, Ar expr ... 437.Ic \&) 438.Xc 439Call the function named by 440.Ar name 441with the argument(s) listed in parentheses. 442Parentheses may be omitted if the function takes no arguments. 443The number of arguments is currently limited to 10. 444.\" -------------------- 445.\" .It Ic c Ns Op Cm /c 446.Tg continue 447.It Xo 448.Ic c Ns Op Ic ontinue 449.Op Cm /c 450.Xc 451Continue execution until a breakpoint or watchpoint. 452If the 453.Cm /c 454modifier is given, instructions are counted while executing. 455.Pp 456.Sy Warning : 457when counting with 458.Cm /c , 459.Nm 460is really silently single-stepping. 461This means that single-stepping on low-level code may cause strange 462behavior. 463.\" -------------------- 464.It Xo 465.Ic watch 466.Ar addr 467.Op Ic \&, Ns Ar size 468.Xc 469Set a watchpoint for the region starting at 470.Ar addr . 471Execution stops and control returns to 472.Nm 473when an attempt is made to modify a watched region. 474The 475.Ar size 476argument defaults to 4. 477.Pp 478If you specify a wrong space address, the request is rejected 479with an error message. 480.Pp 481.Sy Warning : 482attempts to watch wired kernel memory 483may cause an unrecoverable error on some systems (e.g., i386). 484.\" -------------------- 485.It Ic dwatch Ar addr 486Delete the watchpoint at address 487.Ar addr 488that was previously set with a 489.Ic watch 490command. 491.\" -------------------- 492.It Xo 493.Ic hangman 494.Op Cm /s Ns Op Ic 0-9 495.Xc 496This is a tiny and handy tool for random kernel hangs analysis, of which its 497depth is controlled by the optional argument of the default value of five. 498It uses some sophisticated heuristics to spot the global symbol that 499caused the hang. 500Since the discovering algorithm is a probabilistic one, 501you may spend substantial time to figure the exact symbol name. 502This smart thing requires a little of your attention, the input it accepts 503is mostly of the same format as that of the famous 504.Xr hangman 6 505game, to which it, apparently, is obliged by the name. 506Hint: the 507.Xr nm 1 508utility might help. 509.\" -------------------- 510.It Ic until Op Cm /p 511Stop at the next 512.Qq call 513or 514.Qq return 515instruction. 516If the 517.Cm /p 518modifier is specified, 519.Nm 520prints the call nesting depth and the 521cumulative instruction count at each call or return. 522Otherwise, it stays silent until the matching return is hit. 523.\" -------------------- 524.It Ic match Op Cm /p 525Stop at the next matching return instruction. 526If the 527.Cm /p 528modifier is specified, 529.Nm 530prints the call nesting depth and the 531cumulative instruction count at each call or return. 532Otherwise, it remains mostly quiet. 533.\" -------------------- 534.It Ic next Op Cm /p 535The 536.Ic next 537command is a synonym for 538.Ic match . 539.\" -------------------- 540.It Ic kill Ar pid 541Send an uncatchable 542.Dv SIGABRT 543signal to the process specified by the 544.Ar pid 545argument. 546.\" -------------------- 547.It Xo 548.Ic trace 549.Op Cm /tu 550.Op Ar frameaddr Ns 551.Op Ic \&, Ns Ar count 552.Xc 553Show the stack trace. 554The 555.Cm /t 556modifier interprets the 557.Ar frameaddr 558argument as the TID of a process and shows the stack trace of 559that process. 560.Ar frameaddr 561is subject to the radix; use the 0t prefix to enter a decimal TID. 562The 563.Cm /t 564modifier is not supported on all platforms. 565The 566.Cm /u 567modifier shows the stack trace of user space; 568if omitted, the kernel stack is traced instead. 569The 570.Ar count 571argument is the limit on the number of frames to be followed. 572If 573.Ar count 574is omitted, all frames are printed. 575.Pp 576.Sy Warning : 577user space stack trace is valid 578only if the machine dependent code supports it. 579.\" -------------------- 580.It Xo 581.Ic search 582.Op Cm /bhl 583.Op Ar addr 584.Ar value 585.Op Ar mask 586.Op Ic \&, Ns Ar count 587.Xc 588Search memory for a value beginning at 589.Ar addr . 590This command might fail in interesting 591ways if it doesn't find the searched-for value. 592This is because 593.Nm 594doesn't always recover from touching bad memory. 595The optional 596.Ar count 597argument limits the search. 598The modifiers are the same as those of the 599.Ic write 600command. 601.Pp 602The 603.Va next 604address is set to the address where 605.Ar value 606is found, or just after where the search area finishes. 607.\" -------------------- 608.It Ic reboot 609Shortcut for 610.Ic boot reboot 611.\" -------------------- 612.It Ic show Ar what 613Displays various things, depending on 614.Ar what : 615.Bl -tag -width 4n 616.\" -------------------- 617.It Ic show bcstats 618Prints the buffer cache statistics. 619.\" -------------------- 620.It Ic show breaks 621Prints a list of all breakpoints that have been set with the 622.Ic break 623command. 624.\" -------------------- 625.It Xo 626.Ic show buf 627.Op Cm /f 628.Ar addr 629.Xc 630Prints the 631.Vt struct buf 632at 633.Ar addr . 634If the 635.Cm /f 636modifier is specified output will also include 637.Li softdep 638printout, if those are available. 639.\" -------------------- 640.It Ic show extents 641Prints a detailed list of all extents. 642.\" -------------------- 643.It Ic show locks Op Ar addr 644Prints the list of locks held by a thread. 645If an optional address is not specified, 646.Li curproc 647is assumed. 648The 649.Cm option WITNESS 650is required for this command to be available. 651.\" -------------------- 652.It Ic show malloc Op Ar addr 653Prints malloc debugging information if available. 654If an optional address is specified, only information about that address 655is printed. 656.\" -------------------- 657.It Xo 658.Ic show map 659.Op Cm /f 660.Ar addr 661.Xc 662Prints the 663.Li vm_map 664at 665.Ar addr . 666If the 667.Cm /f 668modifier is specified, the complete map is printed. 669.\" -------------------- 670.It Ic show mbuf Ar addr 671Prints the 672.Vt struct mbuf 673header at 674.Ar addr . 675Depending on the mbuf flags 676.Vt struct pkthdr 677and 678.Vt struct m_ext 679are printed as well. 680.\" -------------------- 681.It Xo 682.Ic show mount 683.Op Cm /f 684.Ar addr 685.Xc 686Prints the 687.Vt struct mount 688at 689.Ar addr . 690If the 691.Cm /f 692modifier is specified, prints out all 693.Li vnodes 694(see also 695.Cm show vnode ) 696and also all 697.Li bufs 698(see also 699.Cm show buf ) 700on all those vnodes. 701.\" -------------------- 702.It Xo 703.Ic show nfsnode 704.Op Cm /f 705.Ar addr 706.Xc 707Prints the 708.Vt struct nfsnode 709at 710.Ar addr . 711If the 712.Cm /f 713modifier is specified, prints out additional 714information as well. 715.\" -------------------- 716.It Xo 717.Ic show nfsreq 718.Op Cm /f 719.Ar addr 720.Xc 721Prints the 722.Vt struct nfsreq 723at 724.Ar addr . 725If the 726.Cm /f 727modifier is specified, prints out additional 728information as well. 729.\" -------------------- 730.It Xo 731.Ic show object 732.Op Cm /f 733.Ar addr 734.Xc 735Prints the 736.Li vm_object 737at 738.Ar addr . 739If the 740.Cm /f 741modifier is specified, the complete object is printed. 742.\" -------------------- 743.It Xo 744.Ic show page 745.Op Cm /f 746.Ar addr 747.Xc 748Prints the 749.Li vm_page 750at 751.Ar addr . 752If the 753.Cm /f 754modifier is specified, the complete page is printed. 755.\" -------------------- 756.It Ic show panic 757Prints the panic string. 758.\" -------------------- 759.It Xo 760.Ic show pool 761.Op Cm /p 762.Ar addr 763.Xc 764Prints the 765.Li pool 766at 767.Ar addr . 768Valid modifiers: 769.Bl -tag -width xxx -compact 770.It Cm /p 771Print the pagelist for this pool. 772.El 773.\" -------------------- 774.It Xo 775.Ic show proc 776.Op Cm /t 777.Op Ar addr 778.Xc 779Prints the 780.Vt struct proc 781at 782.Ar addr . 783If an optional address is not specified, 784.Li curproc 785is assumed. 786The 787.Cm /t 788modifier interprets the 789.Ar addr 790argument as the TID of a proc. 791.\" -------------------- 792.It Ic show registers Op Cm /u 793Display the register set. 794If the 795.Cm /u 796modifier is specified, it displays user registers (or the currently 797saved registers) instead of the kernel's. 798Note: The 799.Cm /u 800modifier is not supported on every machine, in which case 801incorrect information may be displayed. 802.\" -------------------- 803.It Ic show route Ar addr 804Prints the 805.Vt struct rtentry 806at 807.Ar addr . 808.\" -------------------- 809.It Ic show socket Ar addr 810Prints the 811.Vt struct socket 812at 813.Ar addr . 814If the socket is spliced, the 815.Vt struct sosplice 816associated with the socket is printed as well. 817.\" -------------------- 818.It Xo 819.Ic show struct 820.Ar name 821.Op addr 822.Xc 823Prints the content of the memory at 824.Ar addr 825as a struct 826.Ar name . 827Nested structures and bit fields are not printed. 828Character arrays are printed as bytes. 829.\" -------------------- 830.It Ic show swap 831Prints a detailed list of all swaps. 832.\" -------------------- 833.It Xo 834.Ic show tdb 835.Op Cm /f 836.Ar addr 837.Xc 838Prints the 839.Vt struct tdb 840at 841.Ar addr . 842If the 843.Cm /f 844modifier is specified, prints out all fields of this IPsec SA. 845.\" -------------------- 846.It Ic show uvmexp 847Displays a selection of uvm counters and statistics. 848.\" -------------------- 849.It Xo 850.Ic show vnode 851.Op Cm /f 852.Ar addr 853.Xc 854Prints the 855.Vt struct vnode 856at 857.Ar addr . 858If the 859.Cm /f 860modifier is specified, prints out all 861.Li bufs 862(see also 863.Cm show buf ) 864currently attached to this 865.Li vnode . 866.\" -------------------- 867.It Ic show watches 868Displays all watchpoints set with the 869.Ic watch 870command. 871.\" -------------------- 872.It Ic show witness Op Cm /b 873Prints the current order list. 874If the 875.Cm /b 876modifier is specified, the list of found lock order violations is printed 877instead. 878The 879.Cm option WITNESS 880is required for this command to be available. 881.\" -------------------- 882.It Ic show all procs Op Cm /anow 883Display information on all processes. 884.Pp 885.Bl -tag -width foo -compact 886.It Cm /n 887(Default) Show process information in a 888.Xr ps 1 Ns \&-like 889format. 890Information printed includes process ID, thread ID, parent 891process ID, UID, process status, process flags, process 892wait channel message and process command name. 893.It Cm /a 894Shows the kernel virtual addresses of each process' 895proc structure, u-area, and vmspace structure. 896The vmspace address is also the address of the process' 897.Li vm_map 898structure 899and can be used in the 900.Ic show map 901command. 902.It Cm /o 903Shows non-idle threads that were on CPU when ddb was entered. 904Information printed includes thread ID, process ID, UID, process flags, 905thread flags, current CPU, and command name. 906.It Cm /w 907Shows each thread's ID, command, process group, 908wait channel address, and wait channel message. 909.El 910.\" -------------------- 911.It Ic show all bufs Op Cm /f 912Display information about all buffers in the system. 913.Pp 914.Bl -tag -width foo -compact 915.It Cm /f 916For each buffer, print a more detailed output. 917See the 918.Ic show buf 919command for more information. 920.El 921.\" -------------------- 922.It Ic show all callout 923Display the contents of the callout table. 924.\" -------------------- 925.It Ic show all pools Op Cm /a 926Display information about all system pools in a format similar to 927.Xr vmstat 8 . 928.Pp 929.Bl -tag -width foo -compact 930.It Cm /a 931Displays 932.Dq interesting 933address information. 934.El 935.\" -------------------- 936.It Ic show all locks 937Prints the list of locks held by all threads in the system. 938The 939.Cm option WITNESS 940is required for this command to be available. 941.\" -------------------- 942.It Ic show all mounts Op Cm /f 943Display information on all mounted filesystems. 944.Pp 945.Bl -tag -width foo -compact 946.It Cm /f 947For each filesystem, list all its struct vnode addresses. 948These addresses can be used in the 949.Ic show vnode 950command. 951.El 952.\" -------------------- 953.It Ic show all nfsnodes Op Cm /f 954Display information about all nfsnodes in the system. 955.Pp 956.Bl -tag -width foo -compact 957.It Cm /f 958For each nfsnode, print a more detailed output. 959See the 960.Ic show nfsnode 961command for more information. 962.El 963.\" -------------------- 964.It Ic show all nfsreqs Op Cm /f 965Display information for all outstanding NFS requests. 966.Pp 967.Bl -tag -width foo -compact 968.It Cm /f 969For each NFS requests, print a more detailed output. 970See the 971.Ic show nfsreq 972command for more information. 973.El 974.\" -------------------- 975.It Xo 976.Ic show all routes 977.Op Cm /iI 978.Op Ar rtableid 979.Op Ic \&, Ns Ar count 980.Xc 981Show internet routing tables. 982Default for 983.Ar rtableid 984is 0 and 985.Ar count 986is 1. 987.Pp 988.Bl -tag -width foo -compact 989.It Cm /i 990Restrict to AF_INET. 991.It Cm /I 992Restrict to AF_INET6. 993.El 994.\" -------------------- 995.It Ic show all tdbs Op Cm /f 996Display information about all IPsec SAs in the system. 997.Pp 998.Bl -tag -width foo -compact 999.It Cm /f 1000For each tdb, print a more detailed output. 1001See the 1002.Ic show tdb 1003command for more information. 1004.El 1005.\" -------------------- 1006.It Ic show all vnodes Op Cm /f 1007Display information about all vnodes in the system. 1008.Pp 1009.Bl -tag -width foo -compact 1010.It Cm /f 1011For each vnode, print a more detailed output. 1012See the 1013.Ic show vnode 1014command for more information. 1015.El 1016.El 1017.\" -------------------- 1018.It Ic callout 1019A synonym for the 1020.Ic show all callout 1021command. 1022.\" -------------------- 1023.It Ic ps Op Cm /anow 1024A synonym for 1025.Ic show all procs . 1026.\" -------------------- 1027.Tg machine 1028.It Xo 1029.Ic mac Ns Op Ic hine 1030.Ar subcommand Op Ar arg ... 1031.Xc 1032Perform a platform-specific command. 1033.Pp 1034The following commands are supported by multiprocessor kernels on 1035these platforms: amd64, i386, macppc, mips64, and sparc64. 1036.Pp 1037.Bl -tag -width "searchframe [addr]" -compact 1038.It Ic cpuinfo 1039Display the state of each CPU. 1040.It Ic ddbcpu Ar N 1041Stop the current CPU and start handling 1042.Nm 1043on the selected CPU. 1044.It Ic startcpu Op Ar N 1045Resume normal processing on the selected CPU, 1046or all CPUs if none is specified. 1047.It Ic stopcpu Op Ar N 1048Stop normal processing on the selected CPU, 1049or all CPUs (except the one handling 1050.Nm ) 1051if none is specified. 1052.El 1053.Pp 1054Other platform-specific commands: 1055.\" .Pp 1056.\" amd64: 1057.Pp 1058arm: 1059.Bl -tag -width "searchframe [addr]" -compact 1060.It Ic frame Ar addr 1061Display the trapframe at 1062.Ar addr . 1063.El 1064.Pp 1065i386: 1066.Bl -tag -width "searchframe [addr]" -compact 1067.\" .It Ic acpi disasm Ar ?? 1068.\" .It Ic acpi showval Ar ?? 1069.\" .It Ic acpi tree Ar ?? 1070.\" .It Ic acpi trace Ar ?? 1071.\" Evil ACPI debugging magic. 1072.It Ic sysregs 1073Display the contents of the privileged registers: 1074.Va IDTR , 1075.Va GDTR , 1076.Va LDTR , 1077.Va TR , 1078.Va CR0 , 1079.Va CR2 , 1080.Va CR3 , 1081and 1082.Va CR4 . 1083.\" (i386-only) 1084.El 1085.Pp 1086m88k: 1087.Bl -tag -width "searchframe [addr]" -compact 1088.It Ic ddbcpu Ar N 1089Stop the current CPU and start handling 1090.Nm 1091on the selected CPU. 1092.It Ic frame Ar addr 1093Display the trapframe at 1094.Ar addr . 1095.It Ic regs 1096Display the registers from when 1097.Nm 1098was entered. 1099.It Ic searchframe Op Ar addr 1100Search for and display stack exception frames, 1101starting from 1102.Ar addr 1103if given, else the address in register 1104.Va r31 , 1105and stopping at the next 8k boundary. 1106.It Ic where 1107Display where the current CPU was stopped. 1108.El 1109.Pp 1110mips64: 1111.Bl -tag -width "searchframe [addr]" -compact 1112.It Xo 1113.Ic tlb Op Cm /p Ar asid 1114.Op Cm /c 1115.Op Ar tlb 1116.Xc 1117.It Ic trap Ar ?? 1118.El 1119.Pp 1120sh: 1121.Bl -tag -width "searchframe [addr]" -compact 1122.It Ic cache Op Ar addr 1123Display the cache, starting from 1124.Ar addr , 1125defaulting to 0. 1126.It Ic frame 1127Display the switch and trap frames. 1128.\" .It Ic stack 1129.It Ic tlb 1130Display the TLB. 1131.El 1132.Pp 1133sparc64: 1134.Bl -tag -width "searchframe [addr]" -compact 1135.It Ic ctx 1136Display the context addresses for all threads. 1137.\" .It Ic dtlb Ar 0,2 1138.\" .It Ic dtsb 1139.\" .It Ic esp 1140.\" .It Ic fpstate Op Ar addr 1141.\" .It Ic itlb Ar 0,1,2 1142.\" .It Ic kmap Op Ar addr 1143.\" .It Ic pcb Op Ar addr 1144.\" .It Ic pctx Ar pid 1145.\" .It Ic page Ar addr 1146.\" .It Ic phys Op Ar addr 1147.\" .It Ic pmap Op Ar addr 1148.\" .It Ic proc Op Ar addr 1149.\" .It Ic prom Ar ?? 1150.\" .It Ic pv Ar addr 1151.\" .It Ic stack Op Ar addr 1152.\" .It Ic tf Op Ar addr 1153.\" .It Ic ts 1154.\" .It Ic traptrace Op Ar addr 1155.\" .It Ic watch Op Ar addr 1156.\" .It Ic window Op Ar winnum 1157.\" .It Ic xir Op Ar addr 1158.El 1159.\" -------------------- 1160.El 1161.Sh VARIABLES 1162.Nm 1163denotes registers and variables by 1164.Ic $ Ns Va name . 1165Register names can be found with the 1166.Ic show registers 1167command. 1168.Pp 1169Some variable names are suffixed with numbers, and some may have a modifier 1170following a colon immediately after the variable name. 1171For example, register variables can have the 1172.Ql :u 1173modifier to indicate a 1174user register (e.g., 1175.Ql $eax:u ) . 1176.Pp 1177Built-in debugger variables currently supported are: 1178.Bl -tag -width 10n -compact -offset indent 1179.It Va $radix 1180Input and output radix. 1181.It Va $maxoff 1182Addresses are printed as 1183.Ar symbol Ns Li + Ns Ar offset 1184unless 1185.Ar offset 1186is greater than 1187.Va $maxoff . 1188.It Va $maxwidth 1189The width of the displayed lines. 1190.It Va $lines 1191The number of lines to page. 1192This is used by the 1193.Dq more 1194feature. 1195.It Va $tabstops 1196Tab stop width. 1197.It Va $log 1198Controls whether the output of 1199.Nm 1200will also appear in the system message 1201buffer. 1202.El 1203.Pp 1204These variables can also be controlled outside 1205.Nm 1206via the 1207.Sq ddb 1208.Xr sysctl 8 1209hierarchy. 1210.Sh EXPRESSIONS 1211Almost all expression operators in C are supported except for 1212.Ql ~ , 1213.Ql ^ , 1214and unary 1215.Ql & . 1216Special rules for expressions in 1217.Nm 1218are: 1219.Bl -tag -width 15n -compact -offset indent 1220.It Ar identifier 1221The name of a symbol. 1222It is translated to the address (or value) of the symbol. 1223.Ql \&. 1224and 1225.Ql \&: 1226can be used in the identifier. 1227The following can be accepted as an identifier, 1228if supported by an object format dependent routine: 1229.Bl -item -offset indent -compact 1230.It 1231.Sm off 1232.Oo Ar filename Li \&: Oc Ar func 1233.Op \&: Ar linenumber 1234.It 1235.Op Ar filename \&: 1236.Ar variable 1237.It 1238.Ar filename 1239.Op \&: Ar linenumber 1240.Sm on 1241.El 1242The symbol may be prefixed with 1243.Sq Ar symboltablename Ns :: 1244(e.g., 1245.Ql emulator::mach_msg_trap ) 1246to specify other than kernel symbols. 1247.It Ar number 1248The radix is determined by the first two letters: 1249.Ql 0x : 1250hex, 1251.Ql 0o : 1252octal, 1253.Ql 0t : 1254decimal, otherwise, the value of 1255.Va $radix 1256is used. 1257.It Li \&. 1258.Va dot : 1259the current address. 1260.It Li + 1261.Va next : 1262the next address. 1263.It Li .. 1264The address of the start of the last line examined. 1265Unlike 1266.Va dot 1267or 1268.Va next , 1269this is only changed by the 1270.Ic examine 1271or 1272.Ic write 1273command. 1274.It Li ' 1275The last address explicitly specified. 1276.It Li $ Ns Ar variable 1277The value of a register or variable. 1278The name may be followed by a 1279.Ql \&: 1280and modifiers as described above with 1281.Ar identifier . 1282.It Ar expr Li # Ar expr 1283A binary operator which rounds up the left hand side to the next 1284multiple of right hand side. 1285.It Li * Ns Ar expr 1286Indirection. 1287It may be followed by a ':' and modifiers as described above. 1288.El 1289.Sh SEE ALSO 1290.Xr ctfstrip 1 , 1291.Xr gdb 1 , 1292.Xr nm 1 , 1293.Xr witness 4 , 1294.Xr sysctl.conf 5 , 1295.Xr hangman 6 , 1296.Xr crash 8 , 1297.Xr sysctl 8 , 1298.Xr extent 9 , 1299.Xr pool 9 , 1300.Xr uvm_init 9 1301.Sh HISTORY 1302This kernel facility first appeared in the MACH 2 operating system 1303developed by CMU. 1304Hangman (which stands for "hangs maniacal analyzer") first appeared in 1305.Ox 1.2 . 1306