DDB(4) | Device Drivers Manual | DDB(4) |
ddb
— kernel
debugger
The ddb
debugger provides a means for
debugging the kernel, and analysing the kernel after a system crash
("panic"), with a
gdb(1)-like syntax.
ddb
is invoked upon a kernel panic when
the sysctl(8)
ddb.panic is set to 1. It may be invoked from the
console when the sysctl ddb.console is set to 1, using
any of the following methods:
Ctrl-Alt-Esc
.BREAK
when using a serial console.Ctrl-Alt-Delete
when the sysctl
machdep.kbdreset is set to 2.ddb
prompts for commands on the console
with:
ddb>
The general syntax of a ddb
command
is:
/
modifiers]
[address][,
count]To save typing, ddb
makes use of a context
inferred from previous commands. In this context, the current location is
called dot. The examine
,
search
, show struct
, and
write
commands update dot to
be that of the last address examined or the last location modified, and have
intuitive effects on next and
prev. All the other commands do not change
dot, and set next to be the
same. (See VARIABLES.)
An expression can be used in place of address (see EXPRESSIONS). Omitting address in a command uses the last value of dot. A missing count is taken to be 1 for printing commands or infinity for stack traces. Entering a blank line causes the last command to be repeated using next in place of address, a count of 1, and no modifiers.
ddb
has a feature like
more(1) for the output. If the
number of lines output in response to one command exceeds the number set in
the $lines variable, it displays the message
‘--db_more--
’ and waits for a
response.
The valid responses are:
space
⟩return
⟩q
The following command line editing keys are provided:
^b
^f
^a
^e
^w
^h
|
⟨del
⟩^d
^k
^u
^p
^n
^r
^t
The following commands may be typed at the
‘ddb>
’ prompt. Some commands
consist of more than one word, and if only the first word or words are
entered, the possible alternatives to complete the command are displayed and
no other action is performed.
help
e
]x
[amine
]
[/bhlqaAxzodurcsmiI
]
[addr][,
count]The format characters are:
/b
/h
/l
/q
/a
/A
/x
/z
/o
/d
/u
/r
/c
/s
/m
/i
/I
The value of next is set to the addr plus the size of the data examined.
print
[/axzodurc
] [addr
[addr ...]]examine
command, and act as described there. If no
modifier is specified, the last one specified in a previous use of
print
is used. The addr
argument can be a string, and it is printed as a literal.
For example,
print/x "eax = " $eax "\necx = " $ecx "\n"
will print something like this:
eax = xxxxxx ecx = yyyyyy
w
[rite
]
[/bhl
] [addr]
expr [expr ...]The value of next is set to addr plus the size of values written.
Warning: since there is no delimiter between expressions, the command may not parse as you expect. It is best to enclose each expression in parentheses.
set
$
name
[=
] exprboot
howboot sync
boot crash
boot dump
boot halt
boot reboot
boot poweroff
break
[addr][,
count]ddb
allows the breakpoint to be silently hit (count
- 1) times before stopping at the break point.
If the break point is successfully set, a break point number
is displayed, in the form
#
number. This can later be
used in deleting the break point or for adding conditions to it.
d
[elete
]
[addr |
#
number]break
command.s
[tep
]
[/p
]
[,
count]/p
modifier is specified, print each instruction
at each step. Otherwise, only print the last instruction.
Warning: depending on machine type, it may not be possible to single-step through some low-level code paths. On machines with software-emulated single-stepping (e.g., alpha), stepping through code executed by interrupt handlers will probably do the wrong thing.
call
name(
expr
[,
expr ...]
)
c
[ontinue
]
[/c
]/c
modifier is given, instructions are counted
while executing.
Warning: when counting with
/c
, ddb
is really
silently single-stepping. This means that single-stepping on low-level
code may cause strange behavior.
watch
addr
[,
size]ddb
when an
attempt is made to modify a watched region. The size
argument defaults to 4.
If you specify a wrong space address, the request is rejected with an error message.
Warning: attempts to watch wired kernel memory may cause an unrecoverable error on some systems (e.g., i386).
dwatch
addrwatch
command.hangman
[/s
[0-9
]]until
[/p
]/p
modifier is specified,
ddb
prints the call nesting depth and the
cumulative instruction count at each call or return. Otherwise, it stays
silent until the matching return is hit.match
[/p
]/p
modifier is specified,
ddb
prints the call nesting depth and the
cumulative instruction count at each call or return. Otherwise, it remains
mostly quiet.next
[/p
]next
command is a synonym for
match
.trace
[/pu
]
[frameaddr][,
count]/p
modifier interprets
the frameaddr argument as the PID of a process and
shows the stack trace of that process. The /p
modifier is not supported on all platforms. The /u
modifier shows the stack trace of user space; if omitted, the kernel stack
is traced instead. The count argument is the limit
on the number of frames to be followed. If count is
omitted, all frames are printed.
Warning: user space stack trace is valid only if the machine dependent code supports it.
search
[/bhl
] [addr]
value [mask]
[,
count]ddb
doesn't always recover
from touching bad memory. The optional count
argument limits the search. The modifiers are the same as those of the
write
command.
The next address is set to the address where value is found, or just after where the search area finishes.
show
whatshow bcstats
show breaks
break
command.show buf
[/f
]
addrstruct buf
at
addr. If the /f
modifier
is specified output will also include softdep
printout, if those are available.show extents
show malloc
[addr]show map
[/f
]
addrvm_map
at
addr. If the /f
modifier
is specified the complete map is printed.show mbuf
addrstruct mbuf
header at
addr. Depending on the mbuf flags
struct pkthdr
and struct
m_ext
are printed as well.show mount
[/f
]
addrstruct mount
at
addr. If the /f
modifier
is specified prints out all vnodes
(see also
show vnode
) and also all
bufs
(see also show
buf
) on all those vnodes.show nfsnode
[/f
]
addrstruct nfsnode
at
addr. If the /f
modifier
is specified prints out additional information as well.show nfsreq
[/f
]
addrstruct nfsreq
at
addr. If the /f
modifier
is specified prints out additional information as well.show object
[/f
]
addrvm_object
at
addr. If the /f
modifier
is specified the complete object is printed.show offset
offsetoption DDB_STRUCT
is required for this command to be available.show page
[/f
]
addrvm_page
at
addr. If the /f
modifier
is specified the complete page is printed.show panic
show pool
[/p
]
addrpool
at addr.
Valid modifiers:
/p
show proc
[addr]struct proc
at
addr. If an optional address is not specified
curproc
is assumed.show registers
[/u
]/u
modifier
is specified, it displays user registers (or the currently saved
registers) instead of the kernel's. Note: The
/u
modifier is not supported on every machine,
in which case incorrect information may be displayed.show socket
addrstruct socket
at
addr. If the socket is spliced, the
struct sosplice
associated with the socket is
printed as well.show struct
name
[addr]option DDB_STRUCT
is required for this command
to be available.show uvmexp
show vnode
[/f
]
addrstruct vnode
at
addr. If the /f
modifier
is specified prints out all bufs
(see also
show buf
) currently attached to this
vnode
.show watches
watch
command.show all procs
[/anow
]/n
/a
vm_map
structure and can be used in the show map
command./o
/w
show all bufs
[/f
]/f
show buf
command for more
information.show all callout
show all pools
[/a
]/a
show all mounts
[/f
]/f
show vnode
command.show all nfsnodes
[/f
]/f
show nfsnode
command for more
information.show all nfsreqs
[/f
]/f
show nfsreq
command for more
information.show all vnodes
[/f
]/f
show vnode
command for more
information.callout
show all callout
command.ps
[/anw
]show all procs
.mac
[hine
]
subcommand [args ...]The following commands are supported by multiprocessor kernels on these platforms: amd64, i386, macppc, mips64, and sparc64.
cpuinfo
ddbcpu
Nddb
on
the selected CPU.startcpu
[N]stopcpu
[N]ddb
) if none is specified.Other platform-specific commands:
arm:
frame
addri386:
sysregs
m88k:
ddbcpu
Nddb
on
the selected CPU.frame
addrregs
ddb
was
entered.searchframe
[addr]where
mips64:
sh:
cache
[addr]frame
tlb
sparc:
proc
??sparc64:
ctx
ddb
denotes registers and variables by
$
name. Register names can be
found with the show registers
command.
Some variable names are suffixed with numbers, and some may have a
modifier following a colon immediately after the variable name. For example,
register variables can have the ‘:u
’
modifier to indicate a user register (e.g.,
‘$eax:u
’).
Built-in debugger variables currently supported are:
+
offset
unless offset is greater than
$maxoff.ddb
will also
appear in the system message buffer.These variables can also be controlled outside
ddb
via the ‘ddb’
sysctl(8) hierarchy.
Almost all expression operators in C are supported except for
‘~
’,
‘^
’, and unary
‘&
’. Special rules for expressions
in ddb
are:
.
’ and
‘:
’ can be used in the identifier.
The following can be accepted as an identifier, if supported by an object
format dependent routine:
:
]func[:linenumber]emulator::mach_msg_trap
’) to
specify other than kernel symbols.0x
’: hex,
‘0o
’: octal,
‘0t
’: decimal, otherwise, the value
of $radix is used..
+
..
examine
or
write
command.'
$
variable:
’ and modifiers as described above
with identifier.#
expr*
exprgdb(1), nm(1), sysctl.conf(5), hangman(6), kgdb(7), crash(8), sysctl(8), extent(9), pool(9), uvm(9)
This kernel facility first appeared in the MACH 2 operating system developed by CMU. Hangman (which stands for "hangs maniacal analyzer") first appeared in OpenBSD 1.2.
March 10, 2016 | OpenBSD-6.0 |