blob: 878d95aaa6e3e21f661e14905cb7a1ef1acb0f59 [file] [log] [blame]
This is, produced by makeinfo version 4.8 from ./gdb.texinfo.
INFO-DIR-SECTION Software development
* Gdb: (gdb). The GNU debugger.
Copyright (C) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996,
1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,
2010 2011, 2012 Free Software Foundation, Inc.
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.3 or
any later version published by the Free Software Foundation; with the
Invariant Sections being "Free Software" and "Free Software Needs Free
Documentation", with the Front-Cover Texts being "A GNU Manual," and
with the Back-Cover Texts as in (a) below.
(a) The FSF's Back-Cover Text is: "You are free to copy and modify
this GNU Manual. Buying copies from GNU Press supports the FSF in
developing GNU and promoting software freedom."
This file documents the GNU debugger GDB.
This is the Tenth Edition, of `Debugging with GDB: the GNU
Source-Level Debugger' for GDB (GDB) Version 7.5.
Copyright (C) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996,
1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,
2010 2011, 2012 Free Software Foundation, Inc.
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.3 or
any later version published by the Free Software Foundation; with the
Invariant Sections being "Free Software" and "Free Software Needs Free
Documentation", with the Front-Cover Texts being "A GNU Manual," and
with the Back-Cover Texts as in (a) below.
(a) The FSF's Back-Cover Text is: "You are free to copy and modify
this GNU Manual. Buying copies from GNU Press supports the FSF in
developing GNU and promoting software freedom."

File:, Node: Auto Display, Next: Print Settings, Prev: Memory, Up: Data
10.7 Automatic Display
If you find that you want to print the value of an expression frequently
(to see how it changes), you might want to add it to the "automatic
display list" so that GDB prints its value each time your program stops.
Each expression added to the list is given a number to identify it; to
remove an expression from the list, you specify that number. The
automatic display looks like this:
2: foo = 38
3: bar[5] = (struct hack *) 0x3804
This display shows item numbers, expressions and their current values.
As with displays you request manually using `x' or `print', you can
specify the output format you prefer; in fact, `display' decides
whether to use `print' or `x' depending your format specification--it
uses `x' if you specify either the `i' or `s' format, or a unit size;
otherwise it uses `print'.
`display EXPR'
Add the expression EXPR to the list of expressions to display each
time your program stops. *Note Expressions: Expressions.
`display' does not repeat if you press <RET> again after using it.
`display/FMT EXPR'
For FMT specifying only a display format and not a size or count,
add the expression EXPR to the auto-display list but arrange to
display it each time in the specified format FMT. *Note Output
Formats: Output Formats.
`display/FMT ADDR'
For FMT `i' or `s', or including a unit-size or a number of units,
add the expression ADDR as a memory address to be examined each
time your program stops. Examining means in effect doing `x/FMT
ADDR'. *Note Examining Memory: Memory.
For example, `display/i $pc' can be helpful, to see the machine
instruction about to be executed each time execution stops (`$pc' is a
common name for the program counter; *note Registers: Registers.).
`undisplay DNUMS...'
`delete display DNUMS...'
Remove items from the list of expressions to display. Specify the
numbers of the displays that you want affected with the command
argument DNUMS. It can be a single display number, one of the
numbers shown in the first field of the `info display' display; or
it could be a range of display numbers, as in `2-4'.
`undisplay' does not repeat if you press <RET> after using it.
(Otherwise you would just get the error `No display number ...'.)
`disable display DNUMS...'
Disable the display of item numbers DNUMS. A disabled display
item is not printed automatically, but is not forgotten. It may be
enabled again later. Specify the numbers of the displays that you
want affected with the command argument DNUMS. It can be a single
display number, one of the numbers shown in the first field of the
`info display' display; or it could be a range of display numbers,
as in `2-4'.
`enable display DNUMS...'
Enable display of item numbers DNUMS. It becomes effective once
again in auto display of its expression, until you specify
otherwise. Specify the numbers of the displays that you want
affected with the command argument DNUMS. It can be a single
display number, one of the numbers shown in the first field of the
`info display' display; or it could be a range of display numbers,
as in `2-4'.
Display the current values of the expressions on the list, just as
is done when your program stops.
`info display'
Print the list of expressions previously set up to display
automatically, each one with its item number, but without showing
the values. This includes disabled expressions, which are marked
as such. It also includes expressions which would not be
displayed right now because they refer to automatic variables not
currently available.
If a display expression refers to local variables, then it does not
make sense outside the lexical context for which it was set up. Such an
expression is disabled when execution enters a context where one of its
variables is not defined. For example, if you give the command
`display last_char' while inside a function with an argument
`last_char', GDB displays this argument while your program continues to
stop inside that function. When it stops elsewhere--where there is no
variable `last_char'--the display is disabled automatically. The next
time your program stops where `last_char' is meaningful, you can enable
the display expression once again.

File:, Node: Print Settings, Next: Pretty Printing, Prev: Auto Display, Up: Data
10.8 Print Settings
GDB provides the following ways to control how arrays, structures, and
symbols are printed.
These settings are useful for debugging programs in any language:
`set print address'
`set print address on'
GDB prints memory addresses showing the location of stack traces,
structure values, pointer values, breakpoints, and so forth, even
when it also displays the contents of those addresses. The default
is `on'. For example, this is what a stack frame display looks
like with `set print address on':
(gdb) f
#0 set_quotes (lq=0x34c78 "<<", rq=0x34c88 ">>")
at input.c:530
530 if (lquote != def_lquote)
`set print address off'
Do not print addresses when displaying their contents. For
example, this is the same stack frame displayed with `set print
address off':
(gdb) set print addr off
(gdb) f
#0 set_quotes (lq="<<", rq=">>") at input.c:530
530 if (lquote != def_lquote)
You can use `set print address off' to eliminate all machine
dependent displays from the GDB interface. For example, with
`print address off', you should get the same text for backtraces on
all machines--whether or not they involve pointer arguments.
`show print address'
Show whether or not addresses are to be printed.
When GDB prints a symbolic address, it normally prints the closest
earlier symbol plus an offset. If that symbol does not uniquely
identify the address (for example, it is a name whose scope is a single
source file), you may need to clarify. One way to do this is with
`info line', for example `info line *0x4537'. Alternately, you can set
GDB to print the source file and line number when it prints a symbolic
`set print symbol-filename on'
Tell GDB to print the source file name and line number of a symbol
in the symbolic form of an address.
`set print symbol-filename off'
Do not print source file name and line number of a symbol. This
is the default.
`show print symbol-filename'
Show whether or not GDB will print the source file name and line
number of a symbol in the symbolic form of an address.
Another situation where it is helpful to show symbol filenames and
line numbers is when disassembling code; GDB shows you the line number
and source file that corresponds to each instruction.
Also, you may wish to see the symbolic form only if the address being
printed is reasonably close to the closest earlier symbol:
`set print max-symbolic-offset MAX-OFFSET'
Tell GDB to only display the symbolic form of an address if the
offset between the closest earlier symbol and the address is less
than MAX-OFFSET. The default is 0, which tells GDB to always
print the symbolic form of an address if any symbol precedes it.
`show print max-symbolic-offset'
Ask how large the maximum offset is that GDB prints in a symbolic
If you have a pointer and you are not sure where it points, try `set
print symbol-filename on'. Then you can determine the name and source
file location of the variable where it points, using `p/a POINTER'.
This interprets the address in symbolic form. For example, here GDB
shows that a variable `ptt' points at another variable `t', defined in
(gdb) set print symbol-filename on
(gdb) p/a ptt
$4 = 0xe008 <t in hi2.c>
_Warning:_ For pointers that point to a local variable, `p/a' does
not show the symbol name and filename of the referent, even with
the appropriate `set print' options turned on.
You can also enable `/a'-like formatting all the time using `set
print symbol on':
`set print symbol on'
Tell GDB to print the symbol corresponding to an address, if one
`set print symbol off'
Tell GDB not to print the symbol corresponding to an address. In
this mode, GDB will still print the symbol corresponding to
pointers to functions. This is the default.
`show print symbol'
Show whether GDB will display the symbol corresponding to an
Other settings control how different kinds of objects are printed:
`set print array'
`set print array on'
Pretty print arrays. This format is more convenient to read, but
uses more space. The default is off.
`set print array off'
Return to compressed format for arrays.
`show print array'
Show whether compressed or pretty format is selected for displaying
`set print array-indexes'
`set print array-indexes on'
Print the index of each element when displaying arrays. May be
more convenient to locate a given element in the array or quickly
find the index of a given element in that printed array. The
default is off.
`set print array-indexes off'
Stop printing element indexes when displaying arrays.
`show print array-indexes'
Show whether the index of each element is printed when displaying
`set print elements NUMBER-OF-ELEMENTS'
Set a limit on how many elements of an array GDB will print. If
GDB is printing a large array, it stops printing after it has
printed the number of elements set by the `set print elements'
command. This limit also applies to the display of strings. When
GDB starts, this limit is set to 200. Setting NUMBER-OF-ELEMENTS
to zero means that the printing is unlimited.
`show print elements'
Display the number of elements of a large array that GDB will
print. If the number is 0, then the printing is unlimited.
`set print frame-arguments VALUE'
This command allows to control how the values of arguments are
printed when the debugger prints a frame (*note Frames::). The
possible values are:
The values of all arguments are printed.
Print the value of an argument only if it is a scalar. The
value of more complex arguments such as arrays, structures,
unions, etc, is replaced by `...'. This is the default.
Here is an example where only scalar arguments are shown:
#1 0x08048361 in call_me (i=3, s=..., ss=0xbf8d508c, u=..., e=green)
at frame-args.c:23
None of the argument values are printed. Instead, the value
of each argument is replaced by `...'. In this case, the
example above now becomes:
#1 0x08048361 in call_me (i=..., s=..., ss=..., u=..., e=...)
at frame-args.c:23
By default, only scalar arguments are printed. This command can
be used to configure the debugger to print the value of all
arguments, regardless of their type. However, it is often
advantageous to not print the value of more complex parameters.
For instance, it reduces the amount of information printed in each
frame, making the backtrace more readable. Also, it improves
performance when displaying Ada frames, because the computation of
large arguments can sometimes be CPU-intensive, especially in
large applications. Setting `print frame-arguments' to `scalars'
(the default) or `none' avoids this computation, thus speeding up
the display of each Ada frame.
`show print frame-arguments'
Show how the value of arguments should be displayed when printing
a frame.
`set print entry-values VALUE'
Set printing of frame argument values at function entry. In some
cases GDB can determine the value of function argument which was
passed by the function caller, even if the value was modified
inside the called function and therefore is different. With
optimized code, the current value could be unavailable, but the
entry value may still be known.
The default value is `default' (see below for its description).
Older GDB behaved as with the setting `no'. Compilers not
supporting this feature will behave in the `default' setting the
same way as with the `no' setting.
This functionality is currently supported only by DWARF 2
debugging format and the compiler has to produce
`DW_TAG_GNU_call_site' tags. With GCC, you need to specify `-O
-g' during compilation, to get this information.
The VALUE parameter can be one of the following:
Print only actual parameter values, never print values from
function entry point.
#0 equal (val=5)
#0 different (val=6)
#0 lost (val=<optimized out>)
#0 born (val=10)
#0 invalid (val=<optimized out>)
Print only parameter values from function entry point. The
actual parameter values are never printed.
#0 equal (val@entry=5)
#0 different (val@entry=5)
#0 lost (val@entry=5)
#0 born (val@entry=<optimized out>)
#0 invalid (val@entry=<optimized out>)
Print only parameter values from function entry point. If
value from function entry point is not known while the actual
value is known, print the actual value for such parameter.
#0 equal (val@entry=5)
#0 different (val@entry=5)
#0 lost (val@entry=5)
#0 born (val=10)
#0 invalid (val@entry=<optimized out>)
Print actual parameter values. If actual parameter value is
not known while value from function entry point is known,
print the entry point value for such parameter.
#0 equal (val=5)
#0 different (val=6)
#0 lost (val@entry=5)
#0 born (val=10)
#0 invalid (val=<optimized out>)
Always print both the actual parameter value and its value
from function entry point, even if values of one or both are
not available due to compiler optimizations.
#0 equal (val=5, val@entry=5)
#0 different (val=6, val@entry=5)
#0 lost (val=<optimized out>, val@entry=5)
#0 born (val=10, val@entry=<optimized out>)
#0 invalid (val=<optimized out>, val@entry=<optimized out>)
Print the actual parameter value if it is known and also its
value from function entry point if it is known. If neither
is known, print for the actual value `<optimized out>'. If
not in MI mode (*note GDB/MI::) and if both values are known
and identical, print the shortened `param=param@entry=VALUE'
#0 equal (val=val@entry=5)
#0 different (val=6, val@entry=5)
#0 lost (val@entry=5)
#0 born (val=10)
#0 invalid (val=<optimized out>)
Always print the actual parameter value. Print also its
value from function entry point, but only if it is known. If
not in MI mode (*note GDB/MI::) and if both values are known
and identical, print the shortened `param=param@entry=VALUE'
#0 equal (val=val@entry=5)
#0 different (val=6, val@entry=5)
#0 lost (val=<optimized out>, val@entry=5)
#0 born (val=10)
#0 invalid (val=<optimized out>)
For analysis messages on possible failures of frame argument
values at function entry resolution see *Note set debug
`show print entry-values'
Show the method being used for printing of frame argument values
at function entry.
`set print repeats'
Set the threshold for suppressing display of repeated array
elements. When the number of consecutive identical elements of an
array exceeds the threshold, GDB prints the string `"<repeats N
times>"', where N is the number of identical repetitions, instead
of displaying the identical elements themselves. Setting the
threshold to zero will cause all elements to be individually
printed. The default threshold is 10.
`show print repeats'
Display the current threshold for printing repeated identical
`set print null-stop'
Cause GDB to stop printing the characters of an array when the
first NULL is encountered. This is useful when large arrays
actually contain only short strings. The default is off.
`show print null-stop'
Show whether GDB stops printing an array on the first NULL
`set print pretty on'
Cause GDB to print structures in an indented format with one member
per line, like this:
$1 = {
next = 0x0,
flags = {
sweet = 1,
sour = 1
meat = 0x54 "Pork"
`set print pretty off'
Cause GDB to print structures in a compact format, like this:
$1 = {next = 0x0, flags = {sweet = 1, sour = 1}, \
meat = 0x54 "Pork"}
This is the default format.
`show print pretty'
Show which format GDB is using to print structures.
`set print sevenbit-strings on'
Print using only seven-bit characters; if this option is set, GDB
displays any eight-bit characters (in strings or character values)
using the notation `\'NNN. This setting is best if you are
working in English (ASCII) and you use the high-order bit of
characters as a marker or "meta" bit.
`set print sevenbit-strings off'
Print full eight-bit characters. This allows the use of more
international character sets, and is the default.
`show print sevenbit-strings'
Show whether or not GDB is printing only seven-bit characters.
`set print union on'
Tell GDB to print unions which are contained in structures and
other unions. This is the default setting.
`set print union off'
Tell GDB not to print unions which are contained in structures and
other unions. GDB will print `"{...}"' instead.
`show print union'
Ask GDB whether or not it will print unions which are contained in
structures and other unions.
For example, given the declarations
typedef enum {Tree, Bug} Species;
typedef enum {Big_tree, Acorn, Seedling} Tree_forms;
typedef enum {Caterpillar, Cocoon, Butterfly}
struct thing {
Species it;
union {
Tree_forms tree;
Bug_forms bug;
} form;
struct thing foo = {Tree, {Acorn}};
with `set print union on' in effect `p foo' would print
$1 = {it = Tree, form = {tree = Acorn, bug = Cocoon}}
and with `set print union off' in effect it would print
$1 = {it = Tree, form = {...}}
`set print union' affects programs written in C-like languages and
in Pascal.
These settings are of interest when debugging C++ programs:
`set print demangle'
`set print demangle on'
Print C++ names in their source form rather than in the encoded
("mangled") form passed to the assembler and linker for type-safe
linkage. The default is on.
`show print demangle'
Show whether C++ names are printed in mangled or demangled form.
`set print asm-demangle'
`set print asm-demangle on'
Print C++ names in their source form rather than their mangled
form, even in assembler code printouts such as instruction
disassemblies. The default is off.
`show print asm-demangle'
Show whether C++ names in assembly listings are printed in mangled
or demangled form.
`set demangle-style STYLE'
Choose among several encoding schemes used by different compilers
to represent C++ names. The choices for STYLE are currently:
Allow GDB to choose a decoding style by inspecting your
Decode based on the GNU C++ compiler (`g++') encoding
algorithm. This is the default.
Decode based on the HP ANSI C++ (`aCC') encoding algorithm.
Decode based on the Lucid C++ compiler (`lcc') encoding
Decode using the algorithm in the `C++ Annotated Reference
Manual'. *Warning:* this setting alone is not sufficient to
allow debugging `cfront'-generated executables. GDB would
require further enhancement to permit that.
If you omit STYLE, you will see a list of possible formats.
`show demangle-style'
Display the encoding style currently in use for decoding C++
`set print object'
`set print object on'
When displaying a pointer to an object, identify the _actual_
(derived) type of the object rather than the _declared_ type, using
the virtual function table. Note that the virtual function table
is required--this feature can only work for objects that have
run-time type identification; a single virtual method in the
object's declared type is sufficient. Note that this setting is
also taken into account when working with variable objects via MI
(*note GDB/MI::).
`set print object off'
Display only the declared type of objects, without reference to the
virtual function table. This is the default setting.
`show print object'
Show whether actual, or declared, object types are displayed.
`set print static-members'
`set print static-members on'
Print static members when displaying a C++ object. The default is
`set print static-members off'
Do not print static members when displaying a C++ object.
`show print static-members'
Show whether C++ static members are printed or not.
`set print pascal_static-members'
`set print pascal_static-members on'
Print static members when displaying a Pascal object. The default
is on.
`set print pascal_static-members off'
Do not print static members when displaying a Pascal object.
`show print pascal_static-members'
Show whether Pascal static members are printed or not.
`set print vtbl'
`set print vtbl on'
Pretty print C++ virtual function tables. The default is off.
(The `vtbl' commands do not work on programs compiled with the HP
ANSI C++ compiler (`aCC').)
`set print vtbl off'
Do not pretty print C++ virtual function tables.
`show print vtbl'
Show whether C++ virtual function tables are pretty printed, or

File:, Node: Pretty Printing, Next: Value History, Prev: Print Settings, Up: Data
10.9 Pretty Printing
GDB provides a mechanism to allow pretty-printing of values using
Python code. It greatly simplifies the display of complex objects.
This mechanism works for both MI and the CLI.
* Menu:
* Pretty-Printer Introduction:: Introduction to pretty-printers
* Pretty-Printer Example:: An example pretty-printer
* Pretty-Printer Commands:: Pretty-printer commands

File:, Node: Pretty-Printer Introduction, Next: Pretty-Printer Example, Up: Pretty Printing
10.9.1 Pretty-Printer Introduction
When GDB prints a value, it first sees if there is a pretty-printer
registered for the value. If there is then GDB invokes the
pretty-printer to print the value. Otherwise the value is printed
Pretty-printers are normally named. This makes them easy to manage.
The `info pretty-printer' command will list all the installed
pretty-printers with their names. If a pretty-printer can handle
multiple data types, then its "subprinters" are the printers for the
individual data types. Each such subprinter has its own name. The
format of the name is PRINTER-NAME;SUBPRINTER-NAME.
Pretty-printers are installed by "registering" them with GDB.
Typically they are automatically loaded and registered when the
corresponding debug information is loaded, thus making them available
without having to do anything special.
There are three places where a pretty-printer can be registered.
* Pretty-printers registered globally are available when debugging
all inferiors.
* Pretty-printers registered with a program space are available only
when debugging that program. *Note Progspaces In Python::, for
more details on program spaces in Python.
* Pretty-printers registered with an objfile are loaded and unloaded
with the corresponding objfile (e.g., shared library). *Note
Objfiles In Python::, for more details on objfiles in Python.
*Note Selecting Pretty-Printers::, for further information on how
pretty-printers are selected,
*Note Writing a Pretty-Printer::, for implementing pretty printers
for new types.

File:, Node: Pretty-Printer Example, Next: Pretty-Printer Commands, Prev: Pretty-Printer Introduction, Up: Pretty Printing
10.9.2 Pretty-Printer Example
Here is how a C++ `std::string' looks without a pretty-printer:
(gdb) print s
$1 = {
static npos = 4294967295,
_M_dataplus = {
<std::allocator<char>> = {
<__gnu_cxx::new_allocator<char>> = {
<No data fields>}, <No data fields>
members of std::basic_string<char, std::char_traits<char>,
std::allocator<char> >::_Alloc_hider:
_M_p = 0x804a014 "abcd"
With a pretty-printer for `std::string' only the contents are
(gdb) print s
$2 = "abcd"

File:, Node: Pretty-Printer Commands, Prev: Pretty-Printer Example, Up: Pretty Printing
10.9.3 Pretty-Printer Commands
`info pretty-printer [OBJECT-REGEXP [NAME-REGEXP]]'
Print the list of installed pretty-printers. This includes
disabled pretty-printers, which are marked as such.
OBJECT-REGEXP is a regular expression matching the objects whose
pretty-printers to list. Objects can be `global', the program
space's file (*note Progspaces In Python::), and the object files
within that program space (*note Objfiles In Python::). *Note
Selecting Pretty-Printers::, for details on how GDB looks up a
printer from these three objects.
NAME-REGEXP is a regular expression matching the name of the
printers to list.
`disable pretty-printer [OBJECT-REGEXP [NAME-REGEXP]]'
Disable pretty-printers matching OBJECT-REGEXP and NAME-REGEXP. A
disabled pretty-printer is not forgotten, it may be enabled again
`enable pretty-printer [OBJECT-REGEXP [NAME-REGEXP]]'
Enable pretty-printers matching OBJECT-REGEXP and NAME-REGEXP.
Suppose we have three pretty-printers installed: one from
named `foo' that prints objects of type `foo', and another from named `bar' that prints two types of objects, `bar1' and
(gdb) info pretty-printer
(gdb) info pretty-printer library2
(gdb) disable pretty-printer library1
1 printer disabled
2 of 3 printers enabled
(gdb) info pretty-printer
foo [disabled]
(gdb) disable pretty-printer library2 bar:bar1
1 printer disabled
1 of 3 printers enabled
(gdb) info pretty-printer library2
foo [disabled]
bar1 [disabled]
(gdb) disable pretty-printer library2 bar
1 printer disabled
0 of 3 printers enabled
(gdb) info pretty-printer library2
foo [disabled]
bar [disabled]
bar1 [disabled]
Note that for `bar' the entire printer can be disabled, as can each
individual subprinter.

File:, Node: Value History, Next: Convenience Vars, Prev: Pretty Printing, Up: Data
10.10 Value History
Values printed by the `print' command are saved in the GDB "value
history". This allows you to refer to them in other expressions.
Values are kept until the symbol table is re-read or discarded (for
example with the `file' or `symbol-file' commands). When the symbol
table changes, the value history is discarded, since the values may
contain pointers back to the types defined in the symbol table.
The values printed are given "history numbers" by which you can
refer to them. These are successive integers starting with one.
`print' shows you the history number assigned to a value by printing
`$NUM = ' before the value; here NUM is the history number.
To refer to any previous value, use `$' followed by the value's
history number. The way `print' labels its output is designed to
remind you of this. Just `$' refers to the most recent value in the
history, and `$$' refers to the value before that. `$$N' refers to the
Nth value from the end; `$$2' is the value just prior to `$$', `$$1' is
equivalent to `$$', and `$$0' is equivalent to `$'.
For example, suppose you have just printed a pointer to a structure
and want to see the contents of the structure. It suffices to type
p *$
If you have a chain of structures where the component `next' points
to the next one, you can print the contents of the next one with this:
p *$.next
You can print successive links in the chain by repeating this
command--which you can do by just typing <RET>.
Note that the history records values, not expressions. If the value
of `x' is 4 and you type these commands:
print x
set x=5
then the value recorded in the value history by the `print' command
remains 4 even though the value of `x' has changed.
`show values'
Print the last ten values in the value history, with their item
numbers. This is like `p $$9' repeated ten times, except that
`show values' does not change the history.
`show values N'
Print ten history values centered on history item number N.
`show values +'
Print ten history values just after the values last printed. If
no more values are available, `show values +' produces no display.
Pressing <RET> to repeat `show values N' has exactly the same effect
as `show values +'.

File:, Node: Convenience Vars, Next: Registers, Prev: Value History, Up: Data
10.11 Convenience Variables
GDB provides "convenience variables" that you can use within GDB to
hold on to a value and refer to it later. These variables exist
entirely within GDB; they are not part of your program, and setting a
convenience variable has no direct effect on further execution of your
program. That is why you can use them freely.
Convenience variables are prefixed with `$'. Any name preceded by
`$' can be used for a convenience variable, unless it is one of the
predefined machine-specific register names (*note Registers:
Registers.). (Value history references, in contrast, are _numbers_
preceded by `$'. *Note Value History: Value History.)
You can save a value in a convenience variable with an assignment
expression, just as you would set a variable in your program. For
set $foo = *object_ptr
would save in `$foo' the value contained in the object pointed to by
Using a convenience variable for the first time creates it, but its
value is `void' until you assign a new value. You can alter the value
with another assignment at any time.
Convenience variables have no fixed types. You can assign a
convenience variable any type of value, including structures and
arrays, even if that variable already has a value of a different type.
The convenience variable, when used as an expression, has the type of
its current value.
`show convenience'
Print a list of convenience variables used so far, and their
values. Abbreviated `show conv'.
`init-if-undefined $VARIABLE = EXPRESSION'
Set a convenience variable if it has not already been set. This
is useful for user-defined commands that keep some state. It is
similar, in concept, to using local static variables with
initializers in C (except that convenience variables are global).
It can also be used to allow users to override default values used
in a command script.
If the variable is already defined then the expression is not
evaluated so any side-effects do not occur.
One of the ways to use a convenience variable is as a counter to be
incremented or a pointer to be advanced. For example, to print a field
from successive elements of an array of structures:
set $i = 0
print bar[$i++]->contents
Repeat that command by typing <RET>.
Some convenience variables are created automatically by GDB and given
values likely to be useful.
The variable `$_' is automatically set by the `x' command to the
last address examined (*note Examining Memory: Memory.). Other
commands which provide a default address for `x' to examine also
set `$_' to that address; these commands include `info line' and
`info breakpoint'. The type of `$_' is `void *' except when set
by the `x' command, in which case it is a pointer to the type of
The variable `$__' is automatically set by the `x' command to the
value found in the last address examined. Its type is chosen to
match the format in which the data was printed.
The variable `$_exitcode' is automatically set to the exit code
when the program being debugged terminates.
Arguments to a static probe. *Note Static Probe Points::.
The variable `$_sdata' contains extra collected static tracepoint
data. *Note Tracepoint Action Lists: Tracepoint Actions. Note
that `$_sdata' could be empty, if not inspecting a trace buffer, or
if extra static tracepoint data has not been collected.
The variable `$_siginfo' contains extra signal information (*note
extra signal information::). Note that `$_siginfo' could be
empty, if the application has not yet received any signals. For
example, it will be empty before you execute the `run' command.
The variable `$_tlb' is automatically set when debugging
applications running on MS-Windows in native mode or connected to
gdbserver that supports the `qGetTIBAddr' request. *Note General
Query Packets::. This variable contains the address of the thread
information block.
On HP-UX systems, if you refer to a function or variable name that
begins with a dollar sign, GDB searches for a user or system name
first, before it searches for a convenience variable.
GDB also supplies some "convenience functions". These have a syntax
similar to convenience variables. A convenience function can be used
in an expression just like an ordinary function; however, a convenience
function is implemented internally to GDB.
`help function'
Print a list of all convenience functions.

File:, Node: Registers, Next: Floating Point Hardware, Prev: Convenience Vars, Up: Data
10.12 Registers
You can refer to machine register contents, in expressions, as variables
with names starting with `$'. The names of registers are different for
each machine; use `info registers' to see the names used on your
`info registers'
Print the names and values of all registers except floating-point
and vector registers (in the selected stack frame).
`info all-registers'
Print the names and values of all registers, including
floating-point and vector registers (in the selected stack frame).
`info registers REGNAME ...'
Print the "relativized" value of each specified register REGNAME.
As discussed in detail below, register values are normally
relative to the selected stack frame. REGNAME may be any register
name valid on the machine you are using, with or without the
initial `$'.
GDB has four "standard" register names that are available (in
expressions) on most machines--whenever they do not conflict with an
architecture's canonical mnemonics for registers. The register names
`$pc' and `$sp' are used for the program counter register and the stack
pointer. `$fp' is used for a register that contains a pointer to the
current stack frame, and `$ps' is used for a register that contains the
processor status. For example, you could print the program counter in
hex with
p/x $pc
or print the instruction to be executed next with
x/i $pc
or add four to the stack pointer(1) with
set $sp += 4
Whenever possible, these four standard register names are available
on your machine even though the machine has different canonical
mnemonics, so long as there is no conflict. The `info registers'
command shows the canonical names. For example, on the SPARC, `info
registers' displays the processor status register as `$psr' but you can
also refer to it as `$ps'; and on x86-based machines `$ps' is an alias
for the EFLAGS register.
GDB always considers the contents of an ordinary register as an
integer when the register is examined in this way. Some machines have
special registers which can hold nothing but floating point; these
registers are considered to have floating point values. There is no way
to refer to the contents of an ordinary register as floating point value
(although you can _print_ it as a floating point value with `print/f
Some registers have distinct "raw" and "virtual" data formats. This
means that the data format in which the register contents are saved by
the operating system is not the same one that your program normally
sees. For example, the registers of the 68881 floating point
coprocessor are always saved in "extended" (raw) format, but all C
programs expect to work with "double" (virtual) format. In such cases,
GDB normally works with the virtual format only (the format that makes
sense for your program), but the `info registers' command prints the
data in both formats.
Some machines have special registers whose contents can be
interpreted in several different ways. For example, modern x86-based
machines have SSE and MMX registers that can hold several values packed
together in several different formats. GDB refers to such registers in
`struct' notation:
(gdb) print $xmm1
$1 = {
v4_float = {0, 3.43859137e-038, 1.54142831e-044, 1.821688e-044},
v2_double = {9.92129282474342e-303, 2.7585945287983262e-313},
v16_int8 = "\000\000\000\000\3706;\001\v\000\000\000\r\000\000",
v8_int16 = {0, 0, 14072, 315, 11, 0, 13, 0},
v4_int32 = {0, 20657912, 11, 13},
v2_int64 = {88725056443645952, 55834574859},
uint128 = 0x0000000d0000000b013b36f800000000
To set values of such registers, you need to tell GDB which view of the
register you wish to change, as if you were assigning value to a
`struct' member:
(gdb) set $xmm1.uint128 = 0x000000000000000000000000FFFFFFFF
Normally, register values are relative to the selected stack frame
(*note Selecting a Frame: Selection.). This means that you get the
value that the register would contain if all stack frames farther in
were exited and their saved registers restored. In order to see the
true contents of hardware registers, you must select the innermost
frame (with `frame 0').
However, GDB must deduce where registers are saved, from the machine
code generated by your compiler. If some registers are not saved, or if
GDB is unable to locate the saved registers, the selected stack frame
makes no difference.
---------- Footnotes ----------
(1) This is a way of removing one word from the stack, on machines
where stacks grow downward in memory (most machines, nowadays). This
assumes that the innermost stack frame is selected; setting `$sp' is
not allowed when other stack frames are selected. To pop entire frames
off the stack, regardless of machine architecture, use `return'; see
*Note Returning from a Function: Returning.

File:, Node: Floating Point Hardware, Next: Vector Unit, Prev: Registers, Up: Data
10.13 Floating Point Hardware
Depending on the configuration, GDB may be able to give you more
information about the status of the floating point hardware.
`info float'
Display hardware-dependent information about the floating point
unit. The exact contents and layout vary depending on the
floating point chip. Currently, `info float' is supported on the
ARM and x86 machines.

File:, Node: Vector Unit, Next: OS Information, Prev: Floating Point Hardware, Up: Data
10.14 Vector Unit
Depending on the configuration, GDB may be able to give you more
information about the status of the vector unit.
`info vector'
Display information about the vector unit. The exact contents and
layout vary depending on the hardware.

File:, Node: OS Information, Next: Memory Region Attributes, Prev: Vector Unit, Up: Data
10.15 Operating System Auxiliary Information
GDB provides interfaces to useful OS facilities that can help you debug
your program.
When GDB runs on a "Posix system" (such as GNU or Unix machines), it
interfaces with the inferior via the `ptrace' system call. The
operating system creates a special sata structure, called `struct
user', for this interface. You can use the command `info udot' to
display the contents of this data structure.
`info udot'
Display the contents of the `struct user' maintained by the OS
kernel for the program being debugged. GDB displays the contents
of `struct user' as a list of hex numbers, similar to the
`examine' command.
Some operating systems supply an "auxiliary vector" to programs at
startup. This is akin to the arguments and environment that you
specify for a program, but contains a system-dependent variety of
binary values that tell system libraries important details about the
hardware, operating system, and process. Each value's purpose is
identified by an integer tag; the meanings are well-known but
system-specific. Depending on the configuration and operating system
facilities, GDB may be able to show you this information. For remote
targets, this functionality may further depend on the remote stub's
support of the `qXfer:auxv:read' packet, see *Note qXfer auxiliary
vector read::.
`info auxv'
Display the auxiliary vector of the inferior, which can be either a
live process or a core dump file. GDB prints each tag value
numerically, and also shows names and text descriptions for
recognized tags. Some values in the vector are numbers, some bit
masks, and some pointers to strings or other data. GDB displays
each value in the most appropriate form for a recognized tag, and
in hexadecimal for an unrecognized tag.
On some targets, GDB can access operating system-specific
information and show it to you. The types of information available
will differ depending on the type of operating system running on the
target. The mechanism used to fetch the data is described in *Note
Operating System Information::. For remote targets, this functionality
depends on the remote stub's support of the `qXfer:osdata:read' packet,
see *Note qXfer osdata read::.
`info os INFOTYPE'
Display OS information of the requested type.
On GNU/Linux, the following values of INFOTYPE are valid:
Display the list of processes on the target. For each
process, GDB prints the process identifier, the name of the
user, the command corresponding to the process, and the list
of processor cores that the process is currently running on.
(To understand what these properties mean, for this and the
following info types, please consult the general GNU/Linux
Display the list of process groups on the target. For each
process, GDB prints the identifier of the process group that
it belongs to, the command corresponding to the process group
leader, the process identifier, and the command line of the
process. The list is sorted first by the process group
identifier, then by the process identifier, so that processes
belonging to the same process group are grouped together and
the process group leader is listed first.
Display the list of threads running on the target. For each
thread, GDB prints the identifier of the process that the
thread belongs to, the command of the process, the thread
identifier, and the processor core that it is currently
running on. The main thread of a process is not listed.
Display the list of open file descriptors on the target. For
each file descriptor, GDB prints the identifier of the process
owning the descriptor, the command of the owning process, the
value of the descriptor, and the target of the descriptor.
Display the list of Internet-domain sockets on the target.
For each socket, GDB prints the address and port of the local
and remote endpoints, the current state of the connection,
the creator of the socket, the IP address family of the
socket, and the type of the connection.
Display the list of all System V shared-memory regions on the
target. For each shared-memory region, GDB prints the region
key, the shared-memory identifier, the access permissions,
the size of the region, the process that created the region,
the process that last attached to or detached from the
region, the current number of live attaches to the region,
and the times at which the region was last attached to,
detach from, and changed.
Display the list of all System V semaphore sets on the
target. For each semaphore set, GDB prints the semaphore set
key, the semaphore set identifier, the access permissions,
the number of semaphores in the set, the user and group of
the owner and creator of the semaphore set, and the times at
which the semaphore set was operated upon and changed.
Display the list of all System V message queues on the
target. For each message queue, GDB prints the message queue
key, the message queue identifier, the access permissions,
the current number of bytes on the queue, the current number
of messages on the queue, the processes that last sent and
received a message on the queue, the user and group of the
owner and creator of the message queue, the times at which a
message was last sent and received on the queue, and the time
at which the message queue was last changed.
Display the list of all loaded kernel modules on the target.
For each module, GDB prints the module name, the size of the
module in bytes, the number of times the module is used, the
dependencies of the module, the status of the module, and the
address of the loaded module in memory.
`info os'
If INFOTYPE is omitted, then list the possible values for INFOTYPE
and the kind of OS information available for each INFOTYPE. If
the target does not return a list of possible types, this command
will report an error.

File:, Node: Memory Region Attributes, Next: Dump/Restore Files, Prev: OS Information, Up: Data
10.16 Memory Region Attributes
"Memory region attributes" allow you to describe special handling
required by regions of your target's memory. GDB uses attributes to
determine whether to allow certain types of memory accesses; whether to
use specific width accesses; and whether to cache target memory. By
default the description of memory regions is fetched from the target
(if the current target supports this), but the user can override the
fetched regions.
Defined memory regions can be individually enabled and disabled.
When a memory region is disabled, GDB uses the default attributes when
accessing memory in that region. Similarly, if no memory regions have
been defined, GDB uses the default attributes when accessing all memory.
When a memory region is defined, it is given a number to identify it;
to enable, disable, or remove a memory region, you specify that number.
Define a memory region bounded by LOWER and UPPER with attributes
ATTRIBUTES..., and add it to the list of regions monitored by GDB.
Note that UPPER == 0 is a special case: it is treated as the
target's maximum memory address. (0xffff on 16 bit targets,
0xffffffff on 32 bit targets, etc.)
`mem auto'
Discard any user changes to the memory regions and use
target-supplied regions, if available, or no regions if the target
does not support.
`delete mem NUMS...'
Remove memory regions NUMS... from the list of regions monitored
by GDB.
`disable mem NUMS...'
Disable monitoring of memory regions NUMS.... A disabled memory
region is not forgotten. It may be enabled again later.
`enable mem NUMS...'
Enable monitoring of memory regions NUMS....
`info mem'
Print a table of all defined memory regions, with the following
columns for each region:
_Memory Region Number_
_Enabled or Disabled._
Enabled memory regions are marked with `y'. Disabled memory
regions are marked with `n'.
_Lo Address_
The address defining the inclusive lower bound of the memory
_Hi Address_
The address defining the exclusive upper bound of the memory
The list of attributes set for this memory region.
10.16.1 Attributes
------------------ Memory Access Mode
The access mode attributes set whether GDB may make read or write
accesses to a memory region.
While these attributes prevent GDB from performing invalid memory
accesses, they do nothing to prevent the target system, I/O DMA, etc.
from accessing memory.
Memory is read only.
Memory is write only.
Memory is read/write. This is the default. Memory Access Size
The access size attribute tells GDB to use specific sized accesses in
the memory region. Often memory mapped device registers require
specific sized accesses. If no access size attribute is specified, GDB
may use accesses of any size.
Use 8 bit memory accesses.
Use 16 bit memory accesses.
Use 32 bit memory accesses.
Use 64 bit memory accesses. Data Cache
The data cache attributes set whether GDB will cache target memory.
While this generally improves performance by reducing debug protocol
overhead, it can lead to incorrect results because GDB does not know
about volatile variables or memory mapped device registers.
Enable GDB to cache target memory.
Disable GDB from caching target memory. This is the default.
10.16.2 Memory Access Checking
GDB can be instructed to refuse accesses to memory that is not
explicitly described. This can be useful if accessing such regions has
undesired effects for a specific target, or to provide better error
checking. The following commands control this behaviour.
`set mem inaccessible-by-default [on|off]'
If `on' is specified, make GDB treat memory not explicitly
described by the memory ranges as non-existent and refuse accesses
to such memory. The checks are only performed if there's at least
one memory range defined. If `off' is specified, make GDB treat
the memory not explicitly described by the memory ranges as RAM.
The default value is `on'.
`show mem inaccessible-by-default'
Show the current handling of accesses to unknown memory.

File:, Node: Dump/Restore Files, Next: Core File Generation, Prev: Memory Region Attributes, Up: Data
10.17 Copy Between Memory and a File
You can use the commands `dump', `append', and `restore' to copy data
between target memory and a file. The `dump' and `append' commands
write data to a file, and the `restore' command reads data from a file
back into the inferior's memory. Files may be in binary, Motorola
S-record, Intel hex, or Tektronix Hex format; however, GDB can only
append to binary files.
Dump the contents of memory from START_ADDR to END_ADDR, or the
value of EXPR, to FILENAME in the given format.
The FORMAT parameter may be any one of:
Raw binary form.
Intel hex format.
Motorola S-record format.
Tektronix Hex format.
GDB uses the same definitions of these formats as the GNU binary
utilities, like `objdump' and `objcopy'. If FORMAT is omitted,
GDB dumps the data in raw binary form.
`append [binary] memory FILENAME START_ADDR END_ADDR'
`append [binary] value FILENAME EXPR'
Append the contents of memory from START_ADDR to END_ADDR, or the
value of EXPR, to the file FILENAME, in raw binary form. (GDB can
only append data to files in raw binary form.)
`restore FILENAME [binary] BIAS START END'
Restore the contents of file FILENAME into memory. The `restore'
command can automatically recognize any known BFD file format,
except for raw binary. To restore a raw binary file you must
specify the optional keyword `binary' after the filename.
If BIAS is non-zero, its value will be added to the addresses
contained in the file. Binary files always start at address zero,
so they will be restored at address BIAS. Other bfd files have a
built-in location; they will be restored at offset BIAS from that
If START and/or END are non-zero, then only data between file
offset START and file offset END will be restored. These offsets
are relative to the addresses in the file, before the BIAS
argument is applied.

File:, Node: Core File Generation, Next: Character Sets, Prev: Dump/Restore Files, Up: Data
10.18 How to Produce a Core File from Your Program
A "core file" or "core dump" is a file that records the memory image of
a running process and its process status (register values etc.). Its
primary use is post-mortem debugging of a program that crashed while it
ran outside a debugger. A program that crashes automatically produces
a core file, unless this feature is disabled by the user. *Note
Files::, for information on invoking GDB in the post-mortem debugging
Occasionally, you may wish to produce a core file of the program you
are debugging in order to preserve a snapshot of its state. GDB has a
special command for that.
`generate-core-file [FILE]'
`gcore [FILE]'
Produce a core dump of the inferior process. The optional argument
FILE specifies the file name where to put the core dump. If not
specified, the file name defaults to `core.PID', where PID is the
inferior process ID.
Note that this command is implemented only for some systems (as of
this writing, GNU/Linux, FreeBSD, Solaris, Unixware, and S390).

File:, Node: Character Sets, Next: Caching Remote Data, Prev: Core File Generation, Up: Data
10.19 Character Sets
If the program you are debugging uses a different character set to
represent characters and strings than the one GDB uses itself, GDB can
automatically translate between the character sets for you. The
character set GDB uses we call the "host character set"; the one the
inferior program uses we call the "target character set".
For example, if you are running GDB on a GNU/Linux system, which
uses the ISO Latin 1 character set, but you are using GDB's remote
protocol (*note Remote Debugging::) to debug a program running on an
IBM mainframe, which uses the EBCDIC character set, then the host
character set is Latin-1, and the target character set is EBCDIC. If
you give GDB the command `set target-charset EBCDIC-US', then GDB
translates between EBCDIC and Latin 1 as you print character or string
values, or use character and string literals in expressions.
GDB has no way to automatically recognize which character set the
inferior program uses; you must tell it, using the `set target-charset'
command, described below.
Here are the commands for controlling GDB's character set support:
`set target-charset CHARSET'
Set the current target character set to CHARSET. To display the
list of supported target character sets, type
`set target-charset <TAB><TAB>'.
`set host-charset CHARSET'
Set the current host character set to CHARSET.
By default, GDB uses a host character set appropriate to the
system it is running on; you can override that default using the
`set host-charset' command. On some systems, GDB cannot
automatically determine the appropriate host character set. In
this case, GDB uses `UTF-8'.
GDB can only use certain character sets as its host character set.
If you type `set host-charset <TAB><TAB>', GDB will list the host
character sets it supports.
`set charset CHARSET'
Set the current host and target character sets to CHARSET. As
above, if you type `set charset <TAB><TAB>', GDB will list the
names of the character sets that can be used for both host and
`show charset'
Show the names of the current host and target character sets.
`show host-charset'
Show the name of the current host character set.
`show target-charset'
Show the name of the current target character set.
`set target-wide-charset CHARSET'
Set the current target's wide character set to CHARSET. This is
the character set used by the target's `wchar_t' type. To display
the list of supported wide character sets, type
`set target-wide-charset <TAB><TAB>'.
`show target-wide-charset'
Show the name of the current target's wide character set.
Here is an example of GDB's character set support in action. Assume
that the following source code has been placed in the file
#include <stdio.h>
char ascii_hello[]
= {72, 101, 108, 108, 111, 44, 32, 119,
111, 114, 108, 100, 33, 10, 0};
char ibm1047_hello[]
= {200, 133, 147, 147, 150, 107, 64, 166,
150, 153, 147, 132, 90, 37, 0};
main ()
printf ("Hello, world!\n");
In this program, `ascii_hello' and `ibm1047_hello' are arrays
containing the string `Hello, world!' followed by a newline, encoded in
the ASCII and IBM1047 character sets.
We compile the program, and invoke the debugger on it:
$ gcc -g charset-test.c -o charset-test
$ gdb -nw charset-test
GNU gdb 2001-12-19-cvs
Copyright 2001 Free Software Foundation, Inc.
We can use the `show charset' command to see what character sets GDB
is currently using to interpret and display characters and strings:
(gdb) show charset
The current host and target character set is `ISO-8859-1'.
For the sake of printing this manual, let's use ASCII as our initial
character set:
(gdb) set charset ASCII
(gdb) show charset
The current host and target character set is `ASCII'.
Let's assume that ASCII is indeed the correct character set for our
host system -- in other words, let's assume that if GDB prints
characters using the ASCII character set, our terminal will display
them properly. Since our current target character set is also ASCII,
the contents of `ascii_hello' print legibly:
(gdb) print ascii_hello
$1 = 0x401698 "Hello, world!\n"
(gdb) print ascii_hello[0]
$2 = 72 'H'
GDB uses the target character set for character and string literals
you use in expressions:
(gdb) print '+'
$3 = 43 '+'
The ASCII character set uses the number 43 to encode the `+'
GDB relies on the user to tell it which character set the target
program uses. If we print `ibm1047_hello' while our target character
set is still ASCII, we get jibberish:
(gdb) print ibm1047_hello
$4 = 0x4016a8 "\310\205\223\223\226k@\246\226\231\223\204Z%"
(gdb) print ibm1047_hello[0]
$5 = 200 '\310'
If we invoke the `set target-charset' followed by <TAB><TAB>, GDB
tells us the character sets it supports:
(gdb) set target-charset
(gdb) set target-charset
We can select IBM1047 as our target character set, and examine the
program's strings again. Now the ASCII string is wrong, but GDB
translates the contents of `ibm1047_hello' from the target character
set, IBM1047, to the host character set, ASCII, and they display
(gdb) set target-charset IBM1047
(gdb) show charset
The current host character set is `ASCII'.
The current target character set is `IBM1047'.
(gdb) print ascii_hello
$6 = 0x401698 "\110\145%%?\054\040\167?\162%\144\041\012"
(gdb) print ascii_hello[0]
$7 = 72 '\110'
(gdb) print ibm1047_hello
$8 = 0x4016a8 "Hello, world!\n"
(gdb) print ibm1047_hello[0]
$9 = 200 'H'
As above, GDB uses the target character set for character and string
literals you use in expressions:
(gdb) print '+'
$10 = 78 '+'
The IBM1047 character set uses the number 78 to encode the `+'

File:, Node: Caching Remote Data, Next: Searching Memory, Prev: Character Sets, Up: Data
10.20 Caching Data of Remote Targets
GDB caches data exchanged between the debugger and a remote target
(*note Remote Debugging::). Such caching generally improves
performance, because it reduces the overhead of the remote protocol by
bundling memory reads and writes into large chunks. Unfortunately,
simply caching everything would lead to incorrect results, since GDB
does not necessarily know anything about volatile values, memory-mapped
I/O addresses, etc. Furthermore, in non-stop mode (*note Non-Stop
Mode::) memory can be changed _while_ a gdb command is executing.
Therefore, by default, GDB only caches data known to be on the stack(1).
Other regions of memory can be explicitly marked as cacheable; see
*note Memory Region Attributes::.
`set remotecache on'
`set remotecache off'
This option no longer does anything; it exists for compatibility
with old scripts.
`show remotecache'
Show the current state of the obsolete remotecache flag.
`set stack-cache on'
`set stack-cache off'
Enable or disable caching of stack accesses. When `ON', use
caching. By default, this option is `ON'.
`show stack-cache'
Show the current state of data caching for memory accesses.
`info dcache [line]'
Print the information about the data cache performance. The
information displayed includes the dcache width and depth, and for
each cache line, its number, address, and how many times it was
referenced. This command is useful for debugging the data cache
If a line number is specified, the contents of that line will be
printed in hex.
`set dcache size SIZE'
Set maximum number of entries in dcache (dcache depth above).
`set dcache line-size LINE-SIZE'
Set number of bytes each dcache entry caches (dcache width above).
Must be a power of 2.
`show dcache size'
Show maximum number of dcache entries. See also *Note info
dcache: Caching Remote Data.
`show dcache line-size'
Show default size of dcache lines. See also *Note info dcache:
Caching Remote Data.
---------- Footnotes ----------
(1) In non-stop mode, it is moderately rare for a running thread to
modify the stack of a stopped thread in a way that would interfere with
a backtrace, and caching of stack reads provides a significant speed up
of remote backtraces.

File:, Node: Searching Memory, Prev: Caching Remote Data, Up: Data
10.21 Search Memory
Memory can be searched for a particular sequence of bytes with the
`find' command.
`find [/SN] START_ADDR, +LEN, VAL1 [, VAL2, ...]'
`find [/SN] START_ADDR, END_ADDR, VAL1 [, VAL2, ...]'
Search memory for the sequence of bytes specified by VAL1, VAL2,
etc. The search begins at address START_ADDR and continues for
either LEN bytes or through to END_ADDR inclusive.
S and N are optional parameters. They may be specified in either
order, apart or together.
S, search query size
The size of each search query value.
halfwords (two bytes)
words (four bytes)
giant words (eight bytes)
All values are interpreted in the current language. This means,
for example, that if the current source language is C/C++ then
searching for the string "hello" includes the trailing '\0'.
If the value size is not specified, it is taken from the value's
type in the current language. This is useful when one wants to
specify the search pattern as a mixture of types. Note that this
means, for example, that in the case of C-like languages a search
for an untyped 0x42 will search for `(int) 0x42' which is
typically four bytes.
N, maximum number of finds
The maximum number of matches to print. The default is to print
all finds.
You can use strings as search values. Quote them with double-quotes
(`"'). The string value is copied into the search pattern byte by
byte, regardless of the endianness of the target and the size
The address of each match found is printed as well as a count of the
number of matches found.
The address of the last value found is stored in convenience variable
`$_'. A count of the number of matches is stored in `$numfound'.
For example, if stopped at the `printf' in this function:
hello ()
static char hello[] = "hello-hello";
static struct { char c; short s; int i; }
__attribute__ ((packed)) mixed
= { 'c', 0x1234, 0x87654321 };
printf ("%s\n", hello);
you get during debugging:
(gdb) find &hello[0], +sizeof(hello), "hello"
0x804956d <hello.1620+6>
1 pattern found
(gdb) find &hello[0], +sizeof(hello), 'h', 'e', 'l', 'l', 'o'
0x8049567 <hello.1620>
0x804956d <hello.1620+6>
2 patterns found
(gdb) find /b1 &hello[0], +sizeof(hello), 'h', 0x65, 'l'
0x8049567 <hello.1620>
1 pattern found
(gdb) find &mixed, +sizeof(mixed), (char) 'c', (short) 0x1234, (int) 0x87654321
0x8049560 <mixed.1625>
1 pattern found
(gdb) print $numfound
$1 = 1
(gdb) print $_
$2 = (void *) 0x8049560

File:, Node: Optimized Code, Next: Macros, Prev: Data, Up: Top
11 Debugging Optimized Code
Almost all compilers support optimization. With optimization disabled,
the compiler generates assembly code that corresponds directly to your
source code, in a simplistic way. As the compiler applies more
powerful optimizations, the generated assembly code diverges from your
original source code. With help from debugging information generated
by the compiler, GDB can map from the running program back to
constructs from your original source.
GDB is more accurate with optimization disabled. If you can
recompile without optimization, it is easier to follow the progress of
your program during debugging. But, there are many cases where you may
need to debug an optimized version.
When you debug a program compiled with `-g -O', remember that the
optimizer has rearranged your code; the debugger shows you what is
really there. Do not be too surprised when the execution path does not
exactly match your source file! An extreme example: if you define a
variable, but never use it, GDB never sees that variable--because the
compiler optimizes it out of existence.
Some things do not work as well with `-g -O' as with just `-g',
particularly on machines with instruction scheduling. If in doubt,
recompile with `-g' alone, and if this fixes the problem, please report
it to us as a bug (including a test case!). *Note Variables::, for
more information about debugging optimized code.
* Menu:
* Inline Functions:: How GDB presents inlining
* Tail Call Frames:: GDB analysis of jumps to functions

File:, Node: Inline Functions, Next: Tail Call Frames, Up: Optimized Code
11.1 Inline Functions
"Inlining" is an optimization that inserts a copy of the function body
directly at each call site, instead of jumping to a shared routine.
GDB displays inlined functions just like non-inlined functions. They
appear in backtraces. You can view their arguments and local
variables, step into them with `step', skip them with `next', and
escape from them with `finish'. You can check whether a function was
inlined by using the `info frame' command.
For GDB to support inlined functions, the compiler must record
information about inlining in the debug information -- GCC using the
DWARF 2 format does this, and several other compilers do also. GDB
only supports inlined functions when using DWARF 2. Versions of GCC
before 4.1 do not emit two required attributes (`DW_AT_call_file' and
`DW_AT_call_line'); GDB does not display inlined function calls with
earlier versions of GCC. It instead displays the arguments and local
variables of inlined functions as local variables in the caller.
The body of an inlined function is directly included at its call
site; unlike a non-inlined function, there are no instructions devoted
to the call. GDB still pretends that the call site and the start of
the inlined function are different instructions. Stepping to the call
site shows the call site, and then stepping again shows the first line
of the inlined function, even though no additional instructions are
This makes source-level debugging much clearer; you can see both the
context of the call and then the effect of the call. Only stepping by
a single instruction using `stepi' or `nexti' does not do this; single
instruction steps always show the inlined body.
There are some ways that GDB does not pretend that inlined function
calls are the same as normal calls:
* Setting breakpoints at the call site of an inlined function may not
work, because the call site does not contain any code. GDB may
incorrectly move the breakpoint to the next line of the enclosing
function, after the call. This limitation will be removed in a
future version of GDB; until then, set a breakpoint on an earlier
line or inside the inlined function instead.
* GDB cannot locate the return value of inlined calls after using
the `finish' command. This is a limitation of compiler-generated
debugging information; after `finish', you can step to the next
line and print a variable where your program stored the return

File:, Node: Tail Call Frames, Prev: Inline Functions, Up: Optimized Code
11.2 Tail Call Frames
Function `B' can call function `C' in its very last statement. In
unoptimized compilation the call of `C' is immediately followed by
return instruction at the end of `B' code. Optimizing compiler may
replace the call and return in function `B' into one jump to function
`C' instead. Such use of a jump instruction is called "tail call".
During execution of function `C', there will be no indication in the
function call stack frames that it was tail-called from `B'. If
function `A' regularly calls function `B' which tail-calls function `C',
then GDB will see `A' as the caller of `C'. However, in some cases GDB
can determine that `C' was tail-called from `B', and it will then
create fictitious call frame for that, with the return address set up
as if `B' called `C' normally.
This functionality is currently supported only by DWARF 2 debugging
format and the compiler has to produce `DW_TAG_GNU_call_site' tags.
With GCC, you need to specify `-O -g' during compilation, to get this
`info frame' command (*note Frame Info::) will indicate the tail
call frame kind by text `tail call frame' such as in this sample GDB
(gdb) x/i $pc - 2
0x40066b <b(int, double)+11>: jmp 0x400640 <c(int, double)>
(gdb) info frame
Stack level 1, frame at 0x7fffffffda30:
rip = 0x40066d in b (; saved rip 0x4004c5
tail call frame, caller of frame at 0x7fffffffda30
source language c++.
Arglist at unknown address.
Locals at unknown address, Previous frame's sp is 0x7fffffffda30
The detection of all the possible code path executions can find them
ambiguous. There is no execution history stored (possible *Note
Reverse Execution:: is never used for this purpose) and the last known
caller could have reached the known callee by multiple different jump
sequences. In such case GDB still tries to show at least all the
unambiguous top tail callers and all the unambiguous bottom tail
calees, if any.
`set debug entry-values'
When set to on, enables printing of analysis messages for both
frame argument values at function entry and tail calls. It will
show all the possible valid tail calls code paths it has
considered. It will also print the intersection of them with the
final unambiguous (possibly partial or even empty) code path
`show debug entry-values'
Show the current state of analysis messages printing for both
frame argument values at function entry and tail calls.
The analysis messages for tail calls can for example show why the
virtual tail call frame for function `c' has not been recognized (due
to the indirect reference by variable `x'):
static void __attribute__((noinline, noclone)) c (void);
void (*x) (void) = c;
static void __attribute__((noinline, noclone)) a (void) { x++; }
static void __attribute__((noinline, noclone)) c (void) { a (); }
int main (void) { x (); return 0; }
Breakpoint 1, DW_OP_GNU_entry_value resolving cannot find
DW_TAG_GNU_call_site 0x40039a in main
a () at t.c:3
3 static void __attribute__((noinline, noclone)) a (void) { x++; }
(gdb) bt
#0 a () at t.c:3
#1 0x000000000040039a in main () at t.c:5
Another possibility is an ambiguous virtual tail call frames
int i;
static void __attribute__((noinline, noclone)) f (void) { i++; }
static void __attribute__((noinline, noclone)) e (void) { f (); }
static void __attribute__((noinline, noclone)) d (void) { f (); }
static void __attribute__((noinline, noclone)) c (void) { d (); }
static void __attribute__((noinline, noclone)) b (void)
{ if (i) c (); else e (); }
static void __attribute__((noinline, noclone)) a (void) { b (); }
int main (void) { a (); return 0; }
tailcall: initial: 0x4004d2(a) 0x4004ce(b) 0x4004b2(c) 0x4004a2(d)
tailcall: compare: 0x4004d2(a) 0x4004cc(b) 0x400492(e)
tailcall: reduced: 0x4004d2(a) |
(gdb) bt
#0 f () at t.c:2
#1 0x00000000004004d2 in a () at t.c:8
#2 0x0000000000400395 in main () at t.c:9
Frames #0 and #2 are real, #1 is a virtual tail call frame. The
code can have possible execution paths `main->a->b->c->d->f' or
`main->a->b->e->f', GDB cannot find which one from the inferior state.
`initial:' state shows some random possible calling sequence GDB has
found. It then finds another possible calling sequcen - that one is
prefixed by `compare:'. The non-ambiguous intersection of these two is
printed as the `reduced:' calling sequence. That one could have many
futher `compare:' and `reduced:' statements as long as there remain any
non-ambiguous sequence entries.
For the frame of function `b' in both cases there are different
possible `$pc' values (`0x4004cc' or `0x4004ce'), therefore this frame
is also ambigous. The only non-ambiguous frame is the one for function
`a', therefore this one is displayed to the user while the ambiguous
frames are omitted.
There can be also reasons why printing of frame argument values at
function entry may fail:
int v;
static void __attribute__((noinline, noclone)) c (int i) { v++; }
static void __attribute__((noinline, noclone)) a (int i);
static void __attribute__((noinline, noclone)) b (int i) { a (i); }
static void __attribute__((noinline, noclone)) a (int i)
{ if (i) b (i - 1); else c (0); }
int main (void) { a (5); return 0; }
(gdb) bt
#0 c (i=i@entry=0) at t.c:2
#1 0x0000000000400428 in a (DW_OP_GNU_entry_value resolving has found
function "a" at 0x400420 can call itself via tail calls
i=<optimized out>) at t.c:6
#2 0x000000000040036e in main () at t.c:7
GDB cannot find out from the inferior state if and how many times did
function `a' call itself (via function `b') as these calls would be
tail calls. Such tail calls would modify thue `i' variable, therefore
GDB cannot be sure the value it knows would be right - GDB prints
`<optimized out>' instead.

File:, Node: Macros, Next: Tracepoints, Prev: Optimized Code, Up: Top
12 C Preprocessor Macros
Some languages, such as C and C++, provide a way to define and invoke
"preprocessor macros" which expand into strings of tokens. GDB can
evaluate expressions containing macro invocations, show the result of
macro expansion, and show a macro's definition, including where it was
You may need to compile your program specially to provide GDB with
information about preprocessor macros. Most compilers do not include
macros in their debugging information, even when you compile with the
`-g' flag. *Note Compilation::.
A program may define a macro at one point, remove that definition
later, and then provide a different definition after that. Thus, at
different points in the program, a macro may have different
definitions, or have no definition at all. If there is a current stack
frame, GDB uses the macros in scope at that frame's source code line.
Otherwise, GDB uses the macros in scope at the current listing location;
see *Note List::.
Whenever GDB evaluates an expression, it always expands any macro
invocations present in the expression. GDB also provides the following
commands for working with macros explicitly.
`macro expand EXPRESSION'
`macro exp EXPRESSION'
Show the results of expanding all preprocessor macro invocations in
EXPRESSION. Since GDB simply expands macros, but does not parse
the result, EXPRESSION need not be a valid expression; it can be
any string of tokens.
`macro expand-once EXPRESSION'
`macro exp1 EXPRESSION'
(This command is not yet implemented.) Show the results of
expanding those preprocessor macro invocations that appear
explicitly in EXPRESSION. Macro invocations appearing in that
expansion are left unchanged. This command allows you to see the
effect of a particular macro more clearly, without being confused
by further expansions. Since GDB simply expands macros, but does
not parse the result, EXPRESSION need not be a valid expression; it
can be any string of tokens.
`info macro [-a|-all] [--] MACRO'
Show the current definition or all definitions of the named MACRO,
and describe the source location or compiler command-line where
that definition was established. The optional double dash is to
signify the end of argument processing and the beginning of MACRO
for non C-like macros where the macro may begin with a hyphen.
`info macros LINESPEC'
Show all macro definitions that are in effect at the location
specified by LINESPEC, and describe the source location or
compiler command-line where those definitions were established.
Introduce a definition for a preprocessor macro named MACRO,
invocations of which are replaced by the tokens given in
REPLACEMENT-LIST. The first form of this command defines an
"object-like" macro, which takes no arguments; the second form
defines a "function-like" macro, which takes the arguments given in
A definition introduced by this command is in scope in every
expression evaluated in GDB, until it is removed with the `macro
undef' command, described below. The definition overrides all
definitions for MACRO present in the program being debugged, as
well as any previous user-supplied definition.
`macro undef MACRO'
Remove any user-supplied definition for the macro named MACRO.
This command only affects definitions provided with the `macro
define' command, described above; it cannot remove definitions
present in the program being debugged.
`macro list'
List all the macros defined using the `macro define' command.
Here is a transcript showing the above commands in action. First, we
show our source files:
$ cat sample.c
#include <stdio.h>
#include "sample.h"
#define M 42
#define ADD(x) (M + x)
main ()
#define N 28
printf ("Hello, world!\n");
#undef N
printf ("We're so creative.\n");
#define N 1729
printf ("Goodbye, world!\n");
$ cat sample.h
#define Q <
Now, we compile the program using the GNU C compiler, GCC. We pass
the `-gdwarf-2'(1) _and_ `-g3' flags to ensure the compiler includes
information about preprocessor macros in the debugging information.
$ gcc -gdwarf-2 -g3 sample.c -o sample
Now, we start GDB on our sample program:
$ gdb -nw sample
GNU gdb 2002-05-06-cvs
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, ...
We can expand macros and examine their definitions, even when the
program is not running. GDB uses the current listing position to
decide which macro definitions are in scope:
(gdb) list main
4 #define M 42
5 #define ADD(x) (M + x)
7 main ()
8 {
9 #define N 28
10 printf ("Hello, world!\n");
11 #undef N
12 printf ("We're so creative.\n");
(gdb) info macro ADD
Defined at /home/jimb/gdb/macros/play/sample.c:5
#define ADD(x) (M + x)
(gdb) info macro Q
Defined at /home/jimb/gdb/macros/play/sample.h:1
included at /home/jimb/gdb/macros/play/sample.c:2
#define Q <
(gdb) macro expand ADD(1)
expands to: (42 + 1)
(gdb) macro expand-once ADD(1)
expands to: once (M + 1)
In the example above, note that `macro expand-once' expands only the
macro invocation explicit in the original text -- the invocation of
`ADD' -- but does not expand the invocation of the macro `M', which was
introduced by `ADD'.
Once the program is running, GDB uses the macro definitions in force
at the source line of the current stack frame:
(gdb) break main
Breakpoint 1 at 0x8048370: file sample.c, line 10.
(gdb) run
Starting program: /home/jimb/gdb/macros/play/sample
Breakpoint 1, main () at sample.c:10
10 printf ("Hello, world!\n");
At line 10, the definition of the macro `N' at line 9 is in force:
(gdb) info macro N
Defined at /home/jimb/gdb/macros/play/sample.c:9
#define N 28
(gdb) macro expand N Q M
expands to: 28 < 42
(gdb) print N Q M
$1 = 1
As we step over directives that remove `N''s definition, and then
give it a new definition, GDB finds the definition (or lack thereof) in
force at each point:
(gdb) next
Hello, world!
12 printf ("We're so creative.\n");
(gdb) info macro N
The symbol `N' has no definition as a C/C++ preprocessor macro
at /home/jimb/gdb/macros/play/sample.c:12
(gdb) next
We're so creative.
14 printf ("Goodbye, world!\n");
(gdb) info macro N
Defined at /home/jimb/gdb/macros/play/sample.c:13
#define N 1729
(gdb) macro expand N Q M
expands to: 1729 < 42
(gdb) print N Q M
$2 = 0
In addition to source files, macros can be defined on the
compilation command line using the `-DNAME=VALUE' syntax. For macros
defined in such a way, GDB displays the location of their definition as
line zero of the source file submitted to the compiler.
(gdb) info macro __STDC__
Defined at /home/jimb/gdb/macros/play/sample.c:0
---------- Footnotes ----------
(1) This is the minimum. Recent versions of GCC support `-gdwarf-3'
and `-gdwarf-4'; we recommend always choosing the most recent version

File:, Node: Tracepoints, Next: Overlays, Prev: Macros, Up: Top
13 Tracepoints
In some applications, it is not feasible for the debugger to interrupt
the program's execution long enough for the developer to learn anything
helpful about its behavior. If the program's correctness depends on
its real-time behavior, delays introduced by a debugger might cause the
program to change its behavior drastically, or perhaps fail, even when
the code itself is correct. It is useful to be able to observe the
program's behavior without interrupting it.
Using GDB's `trace' and `collect' commands, you can specify
locations in the program, called "tracepoints", and arbitrary
expressions to evaluate when those tracepoints are reached. Later,
using the `tfind' command, you can examine the values those expressions
had when the program hit the tracepoints. The expressions may also
denote objects in memory--structures or arrays, for example--whose
values GDB should record; while visiting a particular tracepoint, you
may inspect those objects as if they were in memory at that moment.
However, because GDB records these values without interacting with you,
it can do so quickly and unobtrusively, hopefully not disturbing the
program's behavior.
The tracepoint facility is currently available only for remote
targets. *Note Targets::. In addition, your remote target must know
how to collect trace data. This functionality is implemented in the
remote stub; however, none of the stubs distributed with GDB support
tracepoints as of this writing. The format of the remote packets used
to implement tracepoints are described in *Note Tracepoint Packets::.
It is also possible to get trace data from a file, in a manner
reminiscent of corefiles; you specify the filename, and use `tfind' to
search through the file. *Note Trace Files::, for more details.
This chapter describes the tracepoint commands and features.
* Menu:
* Set Tracepoints::
* Analyze Collected Data::
* Tracepoint Variables::
* Trace Files::

File:, Node: Set Tracepoints, Next: Analyze Collected Data, Up: Tracepoints
13.1 Commands to Set Tracepoints
Before running such a "trace experiment", an arbitrary number of
tracepoints can be set. A tracepoint is actually a special type of
breakpoint (*note Set Breaks::), so you can manipulate it using
standard breakpoint commands. For instance, as with breakpoints,
tracepoint numbers are successive integers starting from one, and many
of the commands associated with tracepoints take the tracepoint number
as their argument, to identify which tracepoint to work on.
For each tracepoint, you can specify, in advance, some arbitrary set
of data that you want the target to collect in the trace buffer when it
hits that tracepoint. The collected data can include registers, local
variables, or global data. Later, you can use GDB commands to examine
the values these data had at the time the tracepoint was hit.
Tracepoints do not support every breakpoint feature. Ignore counts
on tracepoints have no effect, and tracepoints cannot run GDB commands
when they are hit. Tracepoints may not be thread-specific either.
Some targets may support "fast tracepoints", which are inserted in a
different way (such as with a jump instead of a trap), that is faster
but possibly restricted in where they may be installed.
Regular and fast tracepoints are dynamic tracing facilities, meaning
that they can be used to insert tracepoints at (almost) any location in
the target. Some targets may also support controlling "static
tracepoints" from GDB. With static tracing, a set of instrumentation
points, also known as "markers", are embedded in the target program,
and can be activated or deactivated by name or address. These are
usually placed at locations which facilitate investigating what the
target is actually doing. GDB's support for static tracing includes
being able to list instrumentation points, and attach them with GDB
defined high level tracepoints that expose the whole range of
convenience of GDB's tracepoints support. Namely, support for
collecting registers values and values of global or local (to the
instrumentation point) variables; tracepoint conditions and trace state
variables. The act of installing a GDB static tracepoint on an
instrumentation point, or marker, is referred to as "probing" a static
tracepoint marker.
`gdbserver' supports tracepoints on some target systems. *Note
Tracepoints support in `gdbserver': Server.
This section describes commands to set tracepoints and associated
conditions and actions.
* Menu:
* Create and Delete Tracepoints::
* Enable and Disable Tracepoints::
* Tracepoint Passcounts::
* Tracepoint Conditions::
* Trace State Variables::
* Tracepoint Actions::
* Listing Tracepoints::
* Listing Static Tracepoint Markers::
* Starting and Stopping Trace Experiments::
* Tracepoint Restrictions::

File:, Node: Create and Delete Tracepoints, Next: Enable and Disable Tracepoints, Up: Set Tracepoints
13.1.1 Create and Delete Tracepoints
`trace LOCATION'
The `trace' command is very similar to the `break' command. Its
argument LOCATION can be a source line, a function name, or an
address in the target program. *Note Specify Location::. The
`trace' command defines a tracepoint, which is a point in the
target program where the debugger will briefly stop, collect some
data, and then allow the program to continue. Setting a
tracepoint or changing its actions takes effect immediately if the
remote stub supports the `InstallInTrace' feature (*note install
tracepoint in tracing::). If remote stub doesn't support the
`InstallInTrace' feature, all these changes don't take effect
until the next `tstart' command, and once a trace experiment is
running, further changes will not have any effect until the next
trace experiment starts. In addition, GDB supports "pending
tracepoints"--tracepoints whose address is not yet resolved.
(This is similar to pending breakpoints.) Pending tracepoints are
not downloaded to the target and not installed until they are
resolved. The resolution of pending tracepoints requires GDB
support--when debugging with the remote target, and GDB
disconnects from the remote stub (*note disconnected tracing::),
pending tracepoints can not be resolved (and downloaded to the
remote stub) while GDB is disconnected.
Here are some examples of using the `trace' command:
(gdb) trace foo.c:121 // a source file and line number
(gdb) trace +2 // 2 lines forward
(gdb) trace my_function // first source line of function
(gdb) trace *my_function // EXACT start address of function
(gdb) trace *0x2117c4 // an address
You can abbreviate `trace' as `tr'.
`trace LOCATION if COND'
Set a tracepoint with condition COND; evaluate the expression COND
each time the tracepoint is reached, and collect data only if the
value is nonzero--that is, if COND evaluates as true. *Note
Tracepoint Conditions: Tracepoint Conditions, for more information
on tracepoint conditions.
`ftrace LOCATION [ if COND ]'
The `ftrace' command sets a fast tracepoint. For targets that
support them, fast tracepoints will use a more efficient but
possibly less general technique to trigger data collection, such
as a jump instruction instead of a trap, or some sort of hardware
support. It may not be possible to create a fast tracepoint at
the desired location, in which case the command will exit with an
explanatory message.
GDB handles arguments to `ftrace' exactly as for `trace'.
On 32-bit x86-architecture systems, fast tracepoints normally need
to be placed at an instruction that is 5 bytes or longer, but can
be placed at 4-byte instructions if the low 64K of memory of the
target program is available to install trampolines. Some
Unix-type systems, such as GNU/Linux, exclude low addresses from
the program's address space; but for instance with the Linux
kernel it is possible to let GDB use this area by doing a `sysctl'
command to set the `mmap_min_addr' kernel parameter, as in
sudo sysctl -w vm.mmap_min_addr=32768
which sets the low address to 32K, which leaves plenty of room for
trampolines. The minimum address should be set to a page boundary.
`strace LOCATION [ if COND ]'
The `strace' command sets a static tracepoint. For targets that
support it, setting a static tracepoint probes a static
instrumentation point, or marker, found at LOCATION. It may not
be possible to set a static tracepoint at the desired location, in
which case the command will exit with an explanatory message.
GDB handles arguments to `strace' exactly as for `trace', with the
addition that the user can also specify `-m MARKER' as LOCATION.
This probes the marker identified by the MARKER string identifier.
This identifier depends on the static tracepoint backend library
your program is using. You can find all the marker identifiers in
the `ID' field of the `info static-tracepoint-markers' command
output. *Note Listing Static Tracepoint Markers: Listing Static
Tracepoint Markers. For example, in the following small program
using the UST tracing engine:
main ()
trace_mark(ust, bar33, "str %s", "FOOBAZ");
the marker id is composed of joining the first two arguments to the
`trace_mark' call with a slash, which translates to:
(gdb) info static-tracepoint-markers
Cnt Enb ID Address What
1 n ust/bar33 0x0000000000400ddc in main at stexample.c:22
Data: "str %s"
so you may probe the marker above with:
(gdb) strace -m ust/bar33
Static tracepoints accept an extra collect action -- `collect
$_sdata'. This collects arbitrary user data passed in the probe
point call to the tracing library. In the UST example above,
you'll see that the third argument to `trace_mark' is a
printf-like format string. The user data is then the result of
running that formating string against the following arguments.
Note that `info static-tracepoint-markers' command output lists
that format string in the `Data:' field.
You can inspect this data when analyzing the trace buffer, by
printing the $_sdata variable like any other variable available to
GDB. *Note Tracepoint Action Lists: Tracepoint Actions.
The convenience variable `$tpnum' records the tracepoint number of
the most recently set tracepoint.
`delete tracepoint [NUM]'
Permanently delete one or more tracepoints. With no argument, the
default is to delete all tracepoints. Note that the regular
`delete' command can remove tracepoints also.
(gdb) delete trace 1 2 3 // remove three tracepoints
(gdb) delete trace // remove all tracepoints
You can abbreviate this command as `del tr'.

File:, Node: Enable and Disable Tracepoints, Next: Tracepoint Passcounts, Prev: Create and Delete Tracepoints, Up: Set Tracepoints
13.1.2 Enable and Disable Tracepoints
These commands are deprecated; they are equivalent to plain `disable'
and `enable'.
`disable tracepoint [NUM]'
Disable tracepoint NUM, or all tracepoints if no argument NUM is
given. A disabled tracepoint will have no effect during a trace
experiment, but it is not forgotten. You can re-enable a disabled
tracepoint using the `enable tracepoint' command. If the command
is issued during a trace experiment and the debug target has
support for disabling tracepoints during a trace experiment, then
the change will be effective immediately. Otherwise, it will be
applied to the next trace experiment.
`enable tracepoint [NUM]'
Enable tracepoint NUM, or all tracepoints. If this command is
issued during a trace experiment and the debug target supports
enabling tracepoints during a trace experiment, then the enabled
tracepoints will become effective immediately. Otherwise, they
will become effective the next time a trace experiment is run.

File:, Node: Tracepoint Passcounts, Next: Tracepoint Conditions, Prev: Enable and Disable Tracepoints, Up: Set Tracepoints
13.1.3 Tracepoint Passcounts
`passcount [N [NUM]]'
Set the "passcount" of a tracepoint. The passcount is a way to
automatically stop a trace experiment. If a tracepoint's
passcount is N, then the trace experiment will be automatically
stopped on the N'th time that tracepoint is hit. If the
tracepoint number NUM is not specified, the `passcount' command
sets the passcount of the most recently defined tracepoint. If no
passcount is given, the trace experiment will run until stopped
explicitly by the user.
(gdb) passcount 5 2 // Stop on the 5th execution of
`// tracepoint 2'
(gdb) passcount 12 // Stop on the 12th execution of the
`// most recently defined tracepoint.'
(gdb) trace foo
(gdb) pass 3
(gdb) trace bar
(gdb) pass 2
(gdb) trace baz
(gdb) pass 1 // Stop tracing when foo has been
`// executed 3 times OR when bar has'
`// been executed 2 times'
`// OR when baz has been executed 1 time.'

File:, Node: Tracepoint Conditions, Next: Trace State Variables, Prev: Tracepoint Passcounts, Up: Set Tracepoints
13.1.4 Tracepoint Conditions
The simplest sort of tracepoint collects data every time your program
reaches a specified place. You can also specify a "condition" for a
tracepoint. A condition is just a Boolean expression in your
programming language (*note Expressions: Expressions.). A tracepoint
with a condition evaluates the expression each time your program
reaches it, and data collection happens only if the condition is true.
Tracepoint conditions can be specified when a tracepoint is set, by
using `if' in the arguments to the `trace' command. *Note Setting
Tracepoints: Create and Delete Tracepoints. They can also be set or
changed at any time with the `condition' command, just as with
Unlike breakpoint conditions, GDB does not actually evaluate the
conditional expression itself. Instead, GDB encodes the expression
into an agent expression (*note Agent Expressions::) suitable for
execution on the target, independently of GDB. Global variables become
raw memory locations, locals become stack accesses, and so forth.
For instance, suppose you have a function that is usually called
frequently, but should not be called after an error has occurred. You
could use the following tracepoint command to collect data about calls
of that function that happen while the error code is propagating
through the program; an unconditional tracepoint could end up
collecting thousands of useless trace frames that you would have to
search through.
(gdb) trace normal_operation if errcode > 0

File:, Node: Trace State Variables, Next: Tracepoint Actions, Prev: Tracepoint Conditions, Up: Set Tracepoints
13.1.5 Trace State Variables
A "trace state variable" is a special type of variable that is created
and managed by target-side code. The syntax is the same as that for
GDB's convenience variables (a string prefixed with "$"), but they are
stored on the target. They must be created explicitly, using a
`tvariable' command. They are always 64-bit signed integers.
Trace state variables are remembered by GDB, and downloaded to the
target along with tracepoint information when the trace experiment
starts. There are no intrinsic limits on the number of trace state
variables, beyond memory limitations of the target.
Although trace state variables are managed by the target, you can use
them in print commands and expressions as if they were convenience
variables; GDB will get the current value from the target while the
trace experiment is running. Trace state variables share the same
namespace as other "$" variables, which means that you cannot have
trace state variables with names like `$23' or `$pc', nor can you have
a trace state variable and a convenience variable with the same name.
`tvariable $NAME [ = EXPRESSION ]'
The `tvariable' command creates a new trace state variable named
`$NAME', and optionally gives it an initial value of EXPRESSION.
EXPRESSION is evaluated when this command is entered; the result
will be converted to an integer if possible, otherwise GDB will
report an error. A subsequent `tvariable' command specifying the
same name does not create a variable, but instead assigns the
supplied initial value to the existing variable of that name,
overwriting any previous initial value. The default initial value
is 0.
`info tvariables'
List all the trace state variables along with their initial values.
Their current values may also be displayed, if the trace
experiment is currently running.
`delete tvariable [ $NAME ... ]'
Delete the given trace state variables, or all of them if no
arguments are specified.

File:, Node: Tracepoint Actions, Next: Listing Tracepoints, Prev: Trace State Variables, Up: Set Tracepoints
13.1.6 Tracepoint Action Lists
`actions [NUM]'
This command will prompt for a list of actions to be taken when the
tracepoint is hit. If the tracepoint number NUM is not specified,
this command sets the actions for the one that was most recently
defined (so that you can define a tracepoint and then say
`actions' without bothering about its number). You specify the
actions themselves on the following lines, one action at a time,
and terminate the actions list with a line containing just `end'.
So far, the only defined actions are `collect', `teval', and
`actions' is actually equivalent to `commands' (*note Breakpoint
Command Lists: Break Commands.), except that only the defined
actions are allowed; any other GDB command is rejected.
To remove all actions from a tracepoint, type `actions NUM' and
follow it immediately with `end'.
(gdb) collect DATA // collect some data
(gdb) while-stepping 5 // single-step 5 times, collect data
(gdb) end // signals the end of actions.
In the following example, the action list begins with `collect'
commands indicating the things to be collected when the tracepoint
is hit. Then, in order to single-step and collect additional data
following the tracepoint, a `while-stepping' command is used,
followed by the list of things to be collected after each step in a
sequence of single steps. The `while-stepping' command is
terminated by its own separate `end' command. Lastly, the action
list is terminated by an `end' command.
(gdb) trace foo
(gdb) actions
Enter actions for tracepoint 1, one per line:
> collect bar,baz
> collect $regs
> while-stepping 12
> collect $pc, arr[i]
> end
`collect[/MODS] EXPR1, EXPR2, ...'
Collect values of the given expressions when the tracepoint is hit.
This command accepts a comma-separated list of any valid
expressions. In addition to global, static, or local variables,
the following special arguments are supported:
Collect all registers.
Collect all function arguments.
Collect all local variables.
Collect the return address. This is helpful if you want to
see more of a backtrace.
Collects the number of arguments from the static probe at
which the tracepoint is located. *Note Static Probe Points::.
N is an integer between 0 and 11. Collects the Nth argument
from the static probe at which the tracepoint is located.
*Note Static Probe Points::.
Collect static tracepoint marker specific data. Only
available for static tracepoints. *Note Tracepoint Action
Lists: Tracepoint Actions. On the UST static tracepoints
library backend, an instrumentation point resembles a
`printf' function call. The tracing library is able to
collect user specified data formatted to a character string
using the format provided by the programmer that instrumented
the program. Other backends have similar mechanisms. Here's
an example of a UST marker call:
const char master_name[] = "$your_name";
trace_mark(channel1, marker1, "hello %s", master_name)
In this case, collecting `$_sdata' collects the string `hello
$yourname'. When analyzing the trace buffer, you can inspect
`$_sdata' like any other variable available to GDB.
You can give several consecutive `collect' commands, each one with
a single argument, or one `collect' command with several arguments
separated by commas; the effect is the same.
The optional MODS changes the usual handling of the arguments.
`s' requests that pointers to chars be handled as strings, in
particular collecting the contents of the memory being pointed at,
up to the first zero. The upper bound is by default the value of
the `print elements' variable; if `s' is followed by a decimal
number, that is the upper bound instead. So for instance
`collect/s25 mystr' collects as many as 25 characters at `mystr'.
The command `info scope' (*note info scope: Symbols.) is
particularly useful for figuring out what data to collect.
`teval EXPR1, EXPR2, ...'
Evaluate the given expressions when the tracepoint is hit. This
command accepts a comma-separated list of expressions. The results
are discarded, so this is mainly useful for assigning values to
trace state variables (*note Trace State Variables::) without
adding those values to the trace buffer, as would be the case if
the `collect' action were used.
`while-stepping N'
Perform N single-step instruction traces after the tracepoint,
collecting new data after each step. The `while-stepping' command
is followed by the list of what to collect while stepping
(followed by its own `end' command):
> while-stepping 12
> collect $regs, myglobal
> end
Note that `$pc' is not automatically collected by
`while-stepping'; you need to explicitly collect that register if
you need it. You may abbreviate `while-stepping' as `ws' or
`set default-collect EXPR1, EXPR2, ...'
This variable is a list of expressions to collect at each
tracepoint hit. It is effectively an additional `collect' action
prepended to every tracepoint action list. The expressions are
parsed individually for each tracepoint, so for instance a
variable named `xyz' may be interpreted as a global for one
tracepoint, and a local for another, as appropriate to the
tracepoint's location.
`show default-collect'
Show the list of expressions that are collected by default at each
tracepoint hit.

File:, Node: Listing Tracepoints, Next: Listing Static Tracepoint Markers, Prev: Tracepoint Actions, Up: Set Tracepoints
13.1.7 Listing Tracepoints
`info tracepoints [NUM...]'
Display information about the tracepoint NUM. If you don't
specify a tracepoint number, displays information about all the
tracepoints defined so far. The format is similar to that used for
`info breakpoints'; in fact, `info tracepoints' is the same
command, simply restricting itself to tracepoints.
A tracepoint's listing may include additional information specific
to tracing:
* its passcount as given by the `passcount N' command
(gdb) info trace
Num Type Disp Enb Address What
1 tracepoint keep y 0x0804ab57 in foo() at main.cxx:7
while-stepping 20
collect globfoo, $regs
collect globfoo2
pass count 1200
This command can be abbreviated `info tp'.

File:, Node: Listing Static Tracepoint Markers, Next: Starting and Stopping Trace Experiments, Prev: Listing Tracepoints, Up: Set Tracepoints
13.1.8 Listing Static Tracepoint Markers
`info static-tracepoint-markers'
Display information about all static tracepoint markers defined in
the program.
For each marker, the following columns are printed:
An incrementing counter, output to help readability. This is
not a stable identifier.
The marker ID, as reported by the target.
_Enabled or Disabled_
Probed markers are tagged with `y'. `n' identifies marks
that are not enabled.
Where the marker is in your program, as a memory address.
Where the marker is in the source for your program, as a file
and line number. If the debug information included in the
program does not allow GDB to locate the source of the
marker, this column will be left blank.
In addition, the following information may be printed for each
User data passed to the tracing library by the marker call.
In the UST backend, this is the format string passed as
argument to the marker call.
_Static tracepoints probing the marker_
The list of static tracepoints attached to the marker.
(gdb) info static-tracepoint-markers
Cnt ID Enb Address What
1 ust/bar2 y 0x0000000000400e1a in main at stexample.c:25
Data: number1 %d number2 %d
Probed by static tracepoints: #2
2 ust/bar33 n 0x0000000000400c87 in main at stexample.c:24
Data: str %s

File:, Node: Starting and Stopping Trace Experiments, Next: Tracepoint Restrictions, Prev: Listing Static Tracepoint Markers, Up: Set Tracepoints
13.1.9 Starting and Stopping Trace Experiments
This command starts the trace experiment, and begins collecting
data. It has the side effect of discarding all the data collected
in the trace buffer during the previous trace experiment. If any
arguments are supplied, they are taken as a note and stored with
the trace experiment's state. The notes may be arbitrary text,
and are especially useful with disconnected tracing in a
multi-user context; the notes can explain what the trace is doing,
supply user contact information, and so forth.
This command stops the trace experiment. If any arguments are
supplied, they are recorded with the experiment as a note. This is
useful if you are stopping a trace started by someone else, for
instance if the trace is interfering with the system's behavior and
needs to be stopped quickly.
*Note*: a trace experiment and data collection may stop
automatically if any tracepoint's passcount is reached (*note
Tracepoint Passcounts::), or if the trace buffer becomes full.
This command displays the status of the current trace data
Here is an example of the commands we described so far:
(gdb) trace gdb_c_test
(gdb) actions
Enter actions for tracepoint #1, one per line.
> collect $regs,$locals,$args
> while-stepping 11
> collect $regs
> end
> end
(gdb) tstart
[time passes ...]
(gdb) tstop
You can choose to continue running the trace experiment even if GDB
disconnects from the target, voluntarily or involuntarily. For
commands such as `detach', the debugger will ask what you want to do
with the trace. But for unexpected terminations (GDB crash, network
outage), it would be unfortunate to lose hard-won trace data, so the
variable `disconnected-tracing' lets you decide whether the trace should
continue running without GDB.
`set disconnected-tracing on'
`set disconnected-tracing off'
Choose whether a tracing run should continue to run if GDB has
disconnected from the target. Note that `detach' or `quit' will
ask you directly what to do about a running trace no matter what
this variable's setting, so the variable is mainly useful for
handling unexpected situations, such as loss of the network.
`show disconnected-tracing'
Show the current choice for disconnected tracing.
When you reconnect to the target, the trace experiment may or may not
still be running; it might have filled the trace buffer in the
meantime, or stopped for one of the other reasons. If it is running,
it will continue after reconnection.
Upon reconnection, the target will upload information about the
tracepoints in effect. GDB will then compare that information to the
set of tracepoints currently defined, and attempt to match them up,
allowing for the possibility that the numbers may have changed due to
creation and deletion in the meantime. If one of the target's
tracepoints does not match any in GDB, the debugger will create a new
tracepoint, so that you have a number with which to specify that
tracepoint. This matching-up process is necessarily heuristic, and it
may result in useless tracepoints being created; you may simply delete
them if they are of no use.
If your target agent supports a "circular trace buffer", then you
can run a trace experiment indefinitely without filling the trace
buffer; when space runs out, the agent deletes already-collected trace
frames, oldest first, until there is enough room to continue
collecting. This is especially useful if your tracepoints are being
hit too often, and your trace gets terminated prematurely because the
buffer is full. To ask for a circular trace buffer, simply set
`circular-trace-buffer' to on. You can set this at any time, including
during tracing; if the agent can do it, it will change buffer handling
on the fly, otherwise it will not take effect until the next run.
`set circular-trace-buffer on'
`set circular-trace-buffer off'
Choose whether a tracing run should use a linear or circular buffer
for trace data. A linear buffer will not lose any trace data, but
may fill up prematurely, while a circular buffer will discard old
trace data, but it will have always room for the latest tracepoint
`show circular-trace-buffer'
Show the current choice for the trace buffer. Note that this may
not match the agent's current buffer handling, nor is it
guaranteed to match the setting that might have been in effect
during a past run, for instance if you are looking at frames from
a trace file.
`set trace-user TEXT'
`show trace-user'
`set trace-notes TEXT'
Set the trace run's notes.
`show trace-notes'
Show the trace run's notes.
`set trace-stop-notes TEXT'
Set the trace run's stop notes. The handling of the note is as for
`tstop' arguments; the set command is convenient way to fix a stop
note that is mistaken or incomplete.
`show trace-stop-notes'
Show the trace run's stop notes.

File:, Node: Tracepoint Restrictions, Prev: Starting and Stopping Trace Experiments, Up: Set Tracepoints
13.1.10 Tracepoint Restrictions
There are a number of restrictions on the use of tracepoints. As
described above, tracepoint data gathering occurs on the target without
interaction from GDB. Thus the full capabilities of the debugger are
not available during data gathering, and then at data examination time,
you will be limited by only having what was collected. The following
items describe some common problems, but it is not exhaustive, and you
may run into additional difficulties not mentioned here.
* Tracepoint expressions are intended to gather objects (lvalues).
Thus the full flexibility of GDB's expression evaluator is not
available. You cannot call functions, cast objects to aggregate
types, access convenience variables or modify values (except by
assignment to trace state variables). Some language features may
implicitly call functions (for instance Objective-C fields with
accessors), and therefore cannot be collected either.
* Collection of local variables, either individually or in bulk with
`$locals' or `$args', during `while-stepping' may behave
erratically. The stepping action may enter a new scope (for
instance by stepping into a function), or the location of the
variable may change (for instance it is loaded into a register).
The tracepoint data recorded uses the location information for the
variables that is correct for the tracepoint location. When the
tracepoint is created, it is not possible, in general, to determine
where the steps of a `while-stepping' sequence will advance the
program--particularly if a conditional branch is stepped.
* Collection of an incompletely-initialized or partially-destroyed
object may result in something that GDB cannot display, or displays
in a misleading way.
* When GDB displays a pointer to character it automatically
dereferences the pointer to also display characters of the string
being pointed to. However, collecting the pointer during tracing
does not automatically collect the string. You need to explicitly
dereference the pointer and provide size information if you want to
collect not only the pointer, but the memory pointed to. For
example, `*ptr@50' can be used to collect the 50 element array
pointed to by `ptr'.
* It is not possible to collect a complete stack backtrace at a
tracepoint. Instead, you may collect the registers and a few
hundred bytes from the stack pointer with something like
`*(unsigned char *)$esp@300' (adjust to use the name of the actual
stack pointer register on your target architecture, and the amount
of stack you wish to capture). Then the `backtrace' command will
show a partial backtrace when using a trace frame. The number of
stack frames that can be examined depends on the sizes of the
frames in the collected stack. Note that if you ask for a block
so large that it goes past the bottom of the stack, the target
agent may report an error trying to read from an invalid address.
* If you do not collect registers at a tracepoint, GDB can infer
that the value of `$pc' must be the same as the address of the
tracepoint and use that when you are looking at a trace frame for
that tracepoint. However, this cannot work if the tracepoint has
multiple locations (for instance if it was set in a function that
was inlined), or if it has a `while-stepping' loop. In those cases
GDB will warn you that it can't infer `$pc', and default it to

File:, Node: Analyze Collected Data, Next: Tracepoint Variables, Prev: Set Tracepoints, Up: Tracepoints
13.2 Using the Collected Data
After the tracepoint experiment ends, you use GDB commands for
examining the trace data. The basic idea is that each tracepoint
collects a trace "snapshot" every time it is hit and another snapshot
every time it single-steps. All these snapshots are consecutively
numbered from zero and go into a buffer, and you can examine them
later. The way you examine them is to "focus" on a specific trace
snapshot. When the remote stub is focused on a trace snapshot, it will
respond to all GDB requests for memory and registers by reading from
the buffer which belongs to that snapshot, rather than from _real_
memory or registers of the program being debugged. This means that
*all* GDB commands (`print', `info registers', `backtrace', etc.) will
behave as if we were currently debugging the program state as it was
when the tracepoint occurred. Any requests for data that are not in
the buffer will fail.
* Menu:
* tfind:: How to select a trace snapshot
* tdump:: How to display all data for a snapshot
* save tracepoints:: How to save tracepoints for a future run

File:, Node: tfind, Next: tdump, Up: Analyze Collected Data
13.2.1 `tfind N'
The basic command for selecting a trace snapshot from the buffer is
`tfind N', which finds trace snapshot number N, counting from zero. If
no argument N is given, the next snapshot is selected.
Here are the various forms of using the `tfind' command.
`tfind start'
Find the first snapshot in the buffer. This is a synonym for
`tfind 0' (since 0 is the number of the first snapshot).
`tfind none'
Stop debugging trace snapshots, resume _live_ debugging.
`tfind end'
Same as `tfind none'.
No argument means find the next trace snapshot.
`tfind -'
Find the previous trace snapshot before the current one. This
permits retracing earlier steps.
`tfind tracepoint NUM'
Find the next snapshot associated with tracepoint NUM. Search
proceeds forward from the last examined trace snapshot. If no
argument NUM is given, it means find the next snapshot collected
for the same tracepoint as the current snapshot.
`tfind pc ADDR'
Find the next snapshot associated with the value ADDR of the
program counter. Search proceeds forward from the last examined
trace snapshot. If no argument ADDR is given, it means find the
next snapshot with the same value of PC as the current snapshot.
`tfind outside ADDR1, ADDR2'
Find the next snapshot whose PC is outside the given range of
addresses (exclusive).
`tfind range ADDR1, ADDR2'
Find the next snapshot whose PC is between ADDR1 and ADDR2
`tfind line [FILE:]N'
Find the next snapshot associated with the source line N. If the
optional argument FILE is given, refer to line N in that source
file. Search proceeds forward from the last examined trace
snapshot. If no argument N is given, it means find the next line
other than the one currently being examined; thus saying `tfind
line' repeatedly can appear to have the same effect as stepping
from line to line in a _live_ debugging session.
The default arguments for the `tfind' commands are specifically
designed to make it easy to scan through the trace buffer. For
instance, `tfind' with no argument selects the next trace snapshot, and
`tfind -' with no argument selects the previous trace snapshot. So, by
giving one `tfind' command, and then simply hitting <RET> repeatedly
you can examine all the trace snapshots in order. Or, by saying `tfind
-' and then hitting <RET> repeatedly you can examine the snapshots in
reverse order. The `tfind line' command with no argument selects the
snapshot for the next source line executed. The `tfind pc' command with
no argument selects the next snapshot with the same program counter
(PC) as the current frame. The `tfind tracepoint' command with no
argument selects the next trace snapshot collected by the same
tracepoint as the current one.
In addition to letting you scan through the trace buffer manually,
these commands make it easy to construct GDB scripts that scan through
the trace buffer and print out whatever collected data you are
interested in. Thus, if we want to examine the PC, FP, and SP
registers from each trace frame in the buffer, we can say this:
(gdb) tfind start
(gdb) while ($trace_frame != -1)
> printf "Frame %d, PC = %08X, SP = %08X, FP = %08X\n", \
$trace_frame, $pc, $sp, $fp
> tfind
> end
Frame 0, PC = 0020DC64, SP = 0030BF3C, FP = 0030BF44
Frame 1, PC = 0020DC6C, SP = 0030BF38, FP = 0030BF44
Frame 2, PC = 0020DC70, SP = 0030BF34, FP = 0030BF44
Frame 3, PC = 0020DC74, SP = 0030BF30, FP = 0030BF44
Frame 4, PC = 0020DC78, SP = 0030BF2C, FP = 0030BF44
Frame 5, PC = 0020DC7C, SP = 0030BF28, FP = 0030BF44
Frame 6, PC = 0020DC80, SP = 0030BF24, FP = 0030BF44
Frame 7, PC = 0020DC84, SP = 0030BF20, FP = 0030BF44
Frame 8, PC = 0020DC88, SP = 0030BF1C, FP = 0030BF44
Frame 9, PC = 0020DC8E, SP = 0030BF18, FP = 0030BF44
Frame 10, PC = 00203F6C, SP = 0030BE3C, FP = 0030BF14
Or, if we want to examine the variable `X' at each source line in
the buffer:
(gdb) tfind start
(gdb) while ($trace_frame != -1)
> printf "Frame %d, X == %d\n", $trace_frame, X
> tfind line
> end
Frame 0, X = 1
Frame 7, X = 2
Frame 13, X = 255

File:, Node: tdump, Next: save tracepoints, Prev: tfind, Up: Analyze Collected Data
13.2.2 `tdump'
This command takes no arguments. It prints all the data collected at
the current trace snapshot.
(gdb) trace 444
(gdb) actions
Enter actions for tracepoint #2, one per line:
> collect $regs, $locals, $args, gdb_long_test
> end
(gdb) tstart
(gdb) tfind line 444
#0 gdb_test (p1=0x11, p2=0x22, p3=0x33, p4=0x44, p5=0x55, p6=0x66)
at gdb_test.c:444
444 printp( "%s: arguments = 0x%X 0x%X 0x%X 0x%X 0x%X 0x%X\n", )
(gdb) tdump
Data collected at tracepoint 2, trace frame 1:
d0 0xc4aa0085 -995491707
d1 0x18 24
d2 0x80 128
d3 0x33 51
d4 0x71aea3d 119204413
d5 0x22 34
d6 0xe0 224
d7 0x380035 3670069
a0 0x19e24a 1696330
a1 0x3000668 50333288
a2 0x100 256
a3 0x322000 3284992
a4 0x3000698 50333336
a5 0x1ad3cc 1758156
fp 0x30bf3c 0x30bf3c
sp 0x30bf34 0x30bf34
ps 0x0 0
pc 0x20b2c8 0x20b2c8
fpcontrol 0x0 0
fpstatus 0x0 0
fpiaddr 0x0 0
p = 0x20e5b4 "gdb-test"
p1 = (void *) 0x11
p2 = (void *) 0x22
p3 = (void *) 0x33
p4 = (void *) 0x44
p5 = (void *) 0x55
p6 = (void *) 0x66
gdb_long_test = 17 '\021'
`tdump' works by scanning the tracepoint's current collection
actions and printing the value of each expression listed. So `tdump'
can fail, if after a run, you change the tracepoint's actions to
mention variables that were not collected during the run.
Also, for tracepoints with `while-stepping' loops, `tdump' uses the
collected value of `$pc' to distinguish between trace frames that were
collected at the tracepoint hit, and frames that were collected while
stepping. This allows it to correctly choose whether to display the
basic list of collections, or the collections from the body of the
while-stepping loop. However, if `$pc' was not collected, then `tdump'
will always attempt to dump using the basic collection list, and may
fail if a while-stepping frame does not include all the same data that
is collected at the tracepoint hit.

File:, Node: save tracepoints, Prev: tdump, Up: Analyze Collected Data
13.2.3 `save tracepoints FILENAME'
This command saves all current tracepoint definitions together with
their actions and passcounts, into a file `FILENAME' suitable for use
in a later debugging session. To read the saved tracepoint
definitions, use the `source' command (*note Command Files::). The
`save-tracepoints' command is a deprecated alias for `save tracepoints'

File:, Node: Tracepoint Variables, Next: Trace Files, Prev: Analyze Collected Data, Up: Tracepoints
13.3 Convenience Variables for Tracepoints
`(int) $trace_frame'
The current trace snapshot (a.k.a. "frame") number, or -1 if no
snapshot is selected.
`(int) $tracepoint'
The tracepoint for the current trace snapshot.
`(int) $trace_line'
The line number for the current trace snapshot.
`(char []) $trace_file'
The source file for the current trace snapshot.
`(char []) $trace_func'
The name of the function containing `$tracepoint'.
Note: `$trace_file' is not suitable for use in `printf', use
`output' instead.
Here's a simple example of using these convenience variables for
stepping through all the trace snapshots and printing some of their
data. Note that these are not the same as trace state variables, which
are managed by the target.
(gdb) tfind start
(gdb) while $trace_frame != -1
> output $trace_file
> printf ", line %d (tracepoint #%d)\n", $trace_line, $tracepoint
> tfind
> end

File:, Node: Trace Files, Prev: Tracepoint Variables, Up: Tracepoints
13.4 Using Trace Files
In some situations, the target running a trace experiment may no longer
be available; perhaps it crashed, or the hardware was needed for a
different activity. To handle these cases, you can arrange to dump the
trace data into a file, and later use that file as a source of trace
data, via the `target tfile' command.
`tsave [ -r ] FILENAME'
Save the trace data to FILENAME. By default, this command assumes
that FILENAME refers to the host filesystem, so if necessary GDB
will copy raw trace data up from the target and then save it. If
the target supports it, you can also supply the optional argument
`-r' ("remote") to direct the target to save the data directly
into FILENAME in its own filesystem, which may be more efficient
if the trace buffer is very large. (Note, however, that `target
tfile' can only read from files accessible to the host.)
`target tfile FILENAME'
Use the file named FILENAME as a source of trace data. Commands
that examine data work as they do with a live target, but it is not
possible to run any new trace experiments. `tstatus' will report
the state of the trace run at the moment the data was saved, as
well as the current trace frame you are examining. FILENAME must
be on a filesystem accessible to the host.

File:, Node: Overlays, Next: Languages, Prev: Tracepoints, Up: Top
14 Debugging Programs That Use Overlays
If your program is too large to fit completely in your target system's
memory, you can sometimes use "overlays" to work around this problem.
GDB provides some support for debugging programs that use overlays.
* Menu:
* How Overlays Work:: A general explanation of overlays.
* Overlay Commands:: Managing overlays in GDB.
* Automatic Overlay Debugging:: GDB can find out which overlays are
mapped by asking the inferior.
* Overlay Sample Program:: A sample program using overlays.

File:, Node: How Overlays Work, Next: Overlay Commands, Up: Overlays
14.1 How Overlays Work
Suppose you have a computer whose instruction address space is only 64
kilobytes long, but which has much more memory which can be accessed by
other means: special instructions, segment registers, or memory
management hardware, for example. Suppose further that you want to
adapt a program which is larger than 64 kilobytes to run on this system.
One solution is to identify modules of your program which are
relatively independent, and need not call each other directly; call
these modules "overlays". Separate the overlays from the main program,
and place their machine code in the larger memory. Place your main
program in instruction memory, but leave at least enough space there to
hold the largest overlay as well.
Now, to call a function located in an overlay, you must first copy
that overlay's machine code from the large memory into the space set
aside for it in the instruction memory, and then jump to its entry point
Data Instruction Larger
Address Space Address Space Address Space
+-----------+ +-----------+ +-----------+
| | | | | |
+-----------+ +-----------+ +-----------+<-- overlay 1
| program | | main | .----| overlay 1 | load address
| variables | | program | | +-----------+
| and heap | | | | | |
+-----------+ | | | +-----------+<-- overlay 2
| | +-----------+ | | | load address
+-----------+ | | | .-| overlay 2 |
| | | | | |
mapped --->+-----------+ | | +-----------+
address | | | | | |
| overlay | <-' | | |
| area | <---' +-----------+<-- overlay 3
| | <---. | | load address
+-----------+ `--| overlay 3 |
| | | |
+-----------+ | |
| |
A code overlay
The diagram (*note A code overlay::) shows a system with separate
data and instruction address spaces. To map an overlay, the program
copies its code from the larger address space to the instruction
address space. Since the overlays shown here all use the same mapped
address, only one may be mapped at a time. For a system with a single
address space for data and instructions, the diagram would be similar,
except that the program variables and heap would share an address space
with the main program and the overlay area.
An overlay loaded into instruction memory and ready for use is
called a "mapped" overlay; its "mapped address" is its address in the
instruction memory. An overlay not present (or only partially present)
in instruction memory is called "unmapped"; its "load address" is its
address in the larger memory. The mapped address is also called the
"virtual memory address", or "VMA"; the load address is also called the
"load memory address", or "LMA".
Unfortunately, overlays are not a completely transparent way to
adapt a program to limited instruction memory. They introduce a new
set of global constraints you must keep in mind as you design your
* Before calling or returning to a function in an overlay, your
program must make sure that overlay is actually mapped.
Otherwise, the call or return will transfer control to the right
address, but in the wrong overlay, and your program will probably
* If the process of mapping an overlay is expensive on your system,
you will need to choose your overlays carefully to minimize their
effect on your program's performance.
* The executable file you load onto your system must contain each
overlay's instructions, appearing at the overlay's load address,
not its mapped address. However, each overlay's instructions must
be relocated and its symbols defined as if the overlay were at its
mapped address. You can use GNU linker scripts to specify
different load and relocation addresses for pieces of your
program; see *Note Overlay Description: (
* The procedure for loading executable files onto your system must
be able to load their contents into the larger address space as
well as the instruction and data spaces.
The overlay system described above is rather simple, and could be
improved in many ways:
* If your system has suitable bank switch registers or memory
management hardware, you could use those facilities to make an
overlay's load area contents simply appear at their mapped address
in instruction space. This would probably be faster than copying
the overlay to its mapped area in the usual way.
* If your overlays are small enough, you could set aside more than
one overlay area, and have more than one overlay mapped at a time.
* You can use overlays to manage data, as well as instructions. In
general, data overlays are even less transparent to your design
than code overlays: whereas code overlays only require care when
you call or return to functions, data overlays require care every
time you access the data. Also, if you change the contents of a
data overlay, you must copy its contents back out to its load
address before you can copy a different data overlay into the same
mapped area.

File:, Node: Overlay Commands, Next: Automatic Overlay Debugging, Prev: How Overlays Work, Up: Overlays
14.2 Overlay Commands
To use GDB's overlay support, each overlay in your program must
correspond to a separate section of the executable file. The section's
virtual memory address and load memory address must be the overlay's
mapped and load addresses. Identifying overlays with sections allows
GDB to determine the appropriate address of a function or variable,
depending on whether the overlay is mapped or not.
GDB's overlay commands all start with the word `overlay'; you can
abbreviate this as `ov' or `ovly'. The commands are:
`overlay off'
Disable GDB's overlay support. When overlay support is disabled,
GDB assumes that all functions and variables are always present at
their mapped addresses. By default, GDB's overlay support is
`overlay manual'
Enable "manual" overlay debugging. In this mode, GDB relies on
you to tell it which overlays are mapped, and which are not, using
the `overlay map-overlay' and `overlay unmap-overlay' commands
described below.
`overlay map-overlay OVERLAY'
`overlay map OVERLAY'
Tell GDB that OVERLAY is now mapped; OVERLAY must be the name of
the object file section containing the overlay. When an overlay
is mapped, GDB assumes it can find the overlay's functions and
variables at their mapped addresses. GDB assumes that any other
overlays whose mapped ranges overlap that of OVERLAY are now
`overlay unmap-overlay OVERLAY'
`overlay unmap OVERLAY'
Tell GDB that OVERLAY is no longer mapped; OVERLAY must be the
name of the object file section containing the overlay. When an
overlay is unmapped, GDB assumes it can find the overlay's
functions and variables at their load addresses.
`overlay auto'
Enable "automatic" overlay debugging. In this mode, GDB consults
a data structure the overlay manager maintains in the inferior to
see which overlays are mapped. For details, see *Note Automatic
Overlay Debugging::.
`overlay load-target'
`overlay load'
Re-read the overlay table from the inferior. Normally, GDB
re-reads the table GDB automatically each time the inferior stops,
so this command should only be necessary if you have changed the
overlay mapping yourself using GDB. This command is only useful
when using automatic overlay debugging.
`overlay list-overlays'
`overlay list'
Display a list of the overlays currently mapped, along with their
mapped addresses, load addresses, and sizes.
Normally, when GDB prints a code address, it includes the name of
the function the address falls in:
(gdb) print main
$3 = {int ()} 0x11a0 <main>
When overlay debugging is enabled, GDB recognizes code in unmapped
overlays, and prints the names of unmapped functions with asterisks
around them. For example, if `foo' is a function in an unmapped
overlay, GDB prints it this way:
(gdb) overlay list
No sections are mapped.
(gdb) print foo
$5 = {int (int)} 0x100000 <*foo*>
When `foo''s overlay is mapped, GDB prints the function's name
(gdb) overlay list
Section, loaded at 0x100000 - 0x100034,
mapped at 0x1016 - 0x104a
(gdb) print foo
$6 = {int (int)} 0x1016 <foo>
When overlay debugging is enabled, GDB can find the correct address
for functions and variables in an overlay, whether or not the overlay
is mapped. This allows most GDB commands, like `break' and
`disassemble', to work normally, even on unmapped code. However, GDB's
breakpoint support has some limitations:
* You can set breakpoints in functions in unmapped overlays, as long
as GDB can write to the overlay at its load address.
* GDB can not set hardware or simulator-based breakpoints in
unmapped overlays. However, if you set a breakpoint at the end of
your overlay manager (and tell GDB which overlays are now mapped,
if you are using manual overlay management), GDB will re-set its
breakpoints properly.

File:, Node: Automatic Overlay Debugging, Next: Overlay Sample Program, Prev: Overlay Commands, Up: Overlays
14.3 Automatic Overlay Debugging
GDB can automatically track which overlays are mapped and which are
not, given some simple co-operation from the overlay manager in the
inferior. If you enable automatic overlay debugging with the `overlay
auto' command (*note Overlay Commands::), GDB looks in the inferior's
memory for certain variables describing the current state of the