The trace point subcommand bt can be used to trace each execution of a specified address.
bt [-p | -v] [Address [script]]
Each time a trace point is encountered during execution, a message is displayed indicating that the trace point has been encountered. The displayed message indicates the first entry from the stack. However, this can be changed by using the script argument.
If invoked with no arguments the current list of break and trace points is displayed. The number of combined active trace and break points is limited to 32.
It is possible to specify whether the trace address is a physical or virtual address with the -p and -v options. By default KDB chooses the current state of the machine: if the subcommand is entered before VMM initialization, the address is physical (real address), else virtual (effective address).
The segment id (sid) is always used to identify a trace point since effective addresses could have multiple translations in several virtual spaces. When execution is resumed following a trace point being encountered, kdb must reinstall the correct instruction. During this short time (one step if no interrupt is encountered) it is possible to miss the trace on other processors.
The script argument allows a set of kdb subcommands to be executed when a trace point is hit. The set of subcommands comprising the script must be delimited by double quote characters ("). Individual subcommands within the script must be terminated by a semicolon (;). One of the most useful subcommands that can be used in a script is the test subcommand. If this subcommand is included in the script, each time the trace point is hit, the condition of the test subcommand is checked and if it is true a break occurs.
Basic use of the bt subcommand:
KDB(0)> bt open enable trace on open() KDB(0)> bt display current active traces 0: .open+000000 (sid:00000000) trace {hit: 0} KDB(0)> e exit debugger ... open+00000000 (2FF7FF2B, 00000000, DEADBEEF) open+00000000 (2FF7FF2F, 00000000, DEADBEEF) open+00000000 (2FF7FF33, 00000000, DEADBEEF) open+00000000 (2FF7FF37, 00000000, DEADBEEF) open+00000000 (2FF7FF3B, 00000000, DEADBEEF) ... KDB(0)> bt display current active traces 0: .open+000000 (sid:00000000) trace {hit: 5} KDB(0)>
Open routine is traced with a script to display iar and lr registers and to show what is pointed to by r3, the first parameter. Here open() is called on "sbin" from svc_flih().
KDB(0)> bt open "dr iar; dr lr; d @r3" enable trace on open() KDB(0)> bt display current active traces 0: .open+000000 (sid:00000000) trace {hit: 0} {script: dr iar; dr lr;d @r3} KDB(0)> e exit debugger iar : 001C5BA0 .open+000000 mflr r0 <.svc_flih+00011C> lr : 00003B34 .svc_flih+00011C lwz toc,4108(0) toc=TOC,4108=g_toc 2FF7FF3F: 7362 696E 0074 6D70 0074 6F74 6F00 7500 sbin.tmp.toto.u. KDB(0)> bt display current active traces 0: .open+000000 (sid:00000000) trace {hit: 1} {script: dr iar; dr lr;d @r3} KDB(0)> ct open clear trace on open KDB(0)>
This example shows how to trace and stop when a condition is true. Here we are waiting for time global data to be greater than the specified value, and 923 hits have been necessary to reach this condition.
KDB(0)> bt sys_timer "[ @time >= 2b8c8c00 ] " enable trace on sys_timer() KDB(0)> e exit debugger ... Enter kdb [ @time >= 2b8c8c00 ] KDB(0) bt display current active traces 0: .sys_timer+000000 (sid:00000000) trace {hit: 923} {script: [ @time >= 2b8c8c00 ] } KDB(0)> cat clear all traces
The cat and ct subcommands erase all and individual trace points, respectively.
cat
ct slot | [-p | -v] Address
The trace point cleared by the ct subcommand can be specified either by a slot number or an address. It is possible to specify if the address is physical or virtual with -p and -v options. By default KDB chooses the current state of the machine: if the subcommand is entered before VMM initialisation, the address is physical (real address), else virtual (effective address).
KDB(0)> bt open enable trace on open() KDB(0)> bt close enable trace on close() KDB(0)> bt readlink enable trace on readlink() KDB(0)> bt display current active traces 0: .open+000000 (sid:00000000) trace {hit: 0} 1: .close+000000 (sid:00000000) trace {hit: 0} 2: .readlink+000000 (sid:00000000) trace {hit: 0} KDB(0)> ct 1 clear trace slot 1 KDB(0)> bt display current active traces 0: .open+000000 (sid:00000000) trace {hit: 0} 1: .readlink+000000 (sid:00000000) trace {hit: 0} KDB(0)> cat clear all active traces KDB(0)> bt display current active traces No breakpoints are set. KDB(0)>
The trcstart subcommand starts system trace using the kdb command. For more information and to see an example, see trace Subcommand.
trcstart -[f | l] -j event1,eventN -k event1, eventN -p
The trcstop subcommand stops the system trace that was started using the kdb command. For more information and to see an example, see trace Subcommand.
trcstop