Give some hints about debugging live kernels with gdb(1).

1 files changed, 32 insertions, 4 deletions

diff --git a/share/man/man8/crash.8 b/share/man/man8/crash.8
index 6d462f5411c..125b3d5ed57 100644
--- a/share/man/man8/crash.8
+++ b/share/man/man8/crash.8
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: crash.8,v 1.29 2008/12/24 17:15:34 ray Exp $
+.\"	$OpenBSD: crash.8,v 1.30 2009/04/01 22:03:40 kettenis Exp $
 .\"
 .\" Copyright (c) 1980, 1991 The Regents of the University of California.
 .\" All rights reserved.
@@ -29,7 +29,7 @@
 .\"
 .\"	from: @(#)crash.8	6.5 (Berkeley) 4/20/91
 .\"
-.Dd $Mdocdate: December 24 2008 $
+.Dd $Mdocdate: April 1 2009 $
 .Dt CRASH 8
 .Os
 .Sh NAME
@@ -160,13 +160,13 @@ you should run
 loading in the images with the following commands:
 .Bd -literal -offset indent
 # gdb
-GNU gdb 6.1
+GNU gdb 6.3
 Copyright 2004 Free Software Foundation, Inc.
 GDB is free software, covered by the GNU General Public License, and you are
 welcome to change it and/or distribute copies of it under certain conditions.
 Type "show copying" to see the conditions.
 There is absolutely no warranty for GDB.  Type "show warranty" for details.
-This GDB was configured as "i386-unknown-openbsd3.6".
+This GDB was configured as "i386-unknown-openbsd4.6".
 (gdb) file /var/crash/bsd.0
 Reading symbols from /var/crash/bsd.0...(no debugging symbols found)...done.
 (gdb) target kvm /var/crash/bsd.0.core
@@ -266,6 +266,34 @@ You need to add back KERNBASE though, that value can be found in
 .Pp
 This analyzes memory allocations at the time of the crash.
 Perhaps some resource was starving the system?
+.Ss Analyzing a live kernel
+Like the tools mentioned above
+.Xr gdb 1
+can be used to analyze a live system as well.
+This can be accomplished by not specifying a crash dump when selecting the
+.Dq kvm
+target:
+.Bd -literal -offset indent
+(gdb) target kvm
+.Ed
+.Pp
+It is possible to inspect processes that entered the kernel by
+specifying a process'
+.Li struct proc
+address to the
+.IC kvm proc
+command:
+.Bd -literal -offset indent
+(gdb) kvm proc 0xd69dada0
+#0  0xd0355d91 in sleep_finish (sls=0x0, do_sleep=0)
+    at ../../../../kern/kern_synch.c:217
+217                     mi_switch();
+.Ed
+.Pp
+After this, the
+.Ic where
+command will show a trace of prodecure calls, right back to where the
+selected process entered the kernel.
 .Sh CRASH LOCATION DETERMINATION
 The following example should make it easier for a novice kernel
 developer to find out where the kernel crashed.