Copyright (C) 1988-2024 Free Software Foundation, Inc.

   Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.3 or
any later version published by the Free Software Foundation; with the
Invariant Sections being "Free Software" and "Free Software Needs Free
Documentation", with the Front-Cover Texts being "A GNU Manual," and
with the Back-Cover Texts as in (a) below.

   (a) The FSF's Back-Cover Text is: "You are free to copy and modify
this GNU Manual.  Buying copies from GNU Press supports the FSF in
developing GNU and promoting software freedom."

   This file documents the GNU debugger GDB.

   This is the Tenth Edition, of 'Debugging with GDB: the GNU
Source-Level Debugger' for GDB (GDB) Version 16.3.

   Copyright (C) 1988-2024 Free Software Foundation, Inc.

   Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.3 or
any later version published by the Free Software Foundation; with the
Invariant Sections being "Free Software" and "Free Software Needs Free
Documentation", with the Front-Cover Texts being "A GNU Manual," and
with the Back-Cover Texts as in (a) below.

   (a) The FSF's Back-Cover Text is: "You are free to copy and modify
this GNU Manual.  Buying copies from GNU Press supports the FSF in
developing GNU and promoting software freedom."

8 Examining the Stack
*********************

When your program has stopped, the first thing you need to know is where
it stopped and how it got there.

   Each time your program performs a function call, information about
the call is generated.  That information includes the location of the
call in your program, the arguments of the call, and the local variables
of the function being called.  The information is saved in a block of
data called a "stack frame".  The stack frames are allocated in a region
of memory called the "call stack".

   When your program stops, the GDB commands for examining the stack
allow you to see all of this information.

   One of the stack frames is "selected" by GDB and many GDB commands
refer implicitly to the selected frame.  In particular, whenever you ask
GDB for the value of a variable in your program, the value is found in
the selected frame.  There are special GDB commands to select whichever
frame you are interested in.  See Selecting a Frame.

   When your program stops, GDB automatically selects the currently
executing frame and describes it briefly, similar to the 'frame' command
(see Information about a Frame).

8.1 Stack Frames
================

The call stack is divided up into contiguous pieces called "stack
frames", or "frames" for short; each frame is the data associated with
one call to one function.  The frame contains the arguments given to the
function, the function's local variables, and the address at which the
function is executing.

   When your program is started, the stack has only one frame, that of
the function 'main'.  This is called the "initial" frame or the
"outermost" frame.  Each time a function is called, a new frame is made.
Each time a function returns, the frame for that function invocation is
eliminated.  If a function is recursive, there can be many frames for
the same function.  The frame for the function in which execution is
actually occurring is called the "innermost" frame.  This is the most
recently created of all the stack frames that still exist.

   Inside your program, stack frames are identified by their addresses.
A stack frame consists of many bytes, each of which has its own address;
each kind of computer has a convention for choosing one byte whose
address serves as the address of the frame.  Usually this address is
kept in a register called the "frame pointer register" (see $fp)
while execution is going on in that frame.

   GDB labels each existing stack frame with a "level", a number that is
zero for the innermost frame, one for the frame that called it, and so
on upward.  These level numbers give you a way of designating stack
frames in GDB commands.  The terms "frame number" and "frame level" can
be used interchangeably to describe this number.

   Some compilers provide a way to compile functions so that they
operate without stack frames.  (For example, the GCC option
     '-fomit-frame-pointer'
   generates functions without a frame.)  This is occasionally done with
heavily used library functions to save the frame setup time.  GDB has
limited facilities for dealing with these function invocations.  If the
innermost function invocation has no stack frame, GDB nevertheless
regards it as though it had a separate frame, which is numbered zero as
usual, allowing correct tracing of the function call chain.  However,
GDB has no provision for frameless functions elsewhere in the stack.

8.2 Backtraces
==============

A backtrace is a summary of how your program got where it is.  It shows
one line per frame, for many frames, starting with the currently
executing frame (frame zero), followed by its caller (frame one), and on
up the stack.

   To print a backtrace of the entire stack, use the 'backtrace'
command, or its alias 'bt'.  This command will print one line per frame
for frames in the stack.  By default, all stack frames are printed.  You
can stop the backtrace at any time by typing the system interrupt
character, normally 'Ctrl-c'.

'backtrace [OPTION]... [QUALIFIER]... [COUNT]'
'bt [OPTION]... [QUALIFIER]... [COUNT]'
     Print the backtrace of the entire stack.

     The optional COUNT can be one of the following:

     'N'
     'N'
          Print only the innermost N frames, where N is a positive
          number.

     '-N'
     '-N'
          Print only the outermost N frames, where N is a positive
          number.

     Options:

     '-full'
          Print the values of the local variables also.  This can be
          combined with the optional COUNT to limit the number of frames
          shown.

     '-no-filters'
          Do not run Python frame filters on this backtrace.  See
          Frame Filter API, for more information.  Additionally use
          disable frame-filter all to turn off all frame
          filters.  This is only relevant when GDB has been configured
          with 'Python' support.

     '-hide'
          A Python frame filter might decide to "elide" some frames.
          Normally such elided frames are still printed, but they are
          indented relative to the filtered frames that cause them to be
          elided.  The '-hide' option causes elided frames to not be
          printed at all.

     The 'backtrace' command also supports a number of options that
     allow overriding relevant global print settings as set by 'set
     backtrace' and 'set print' subcommands:

     '-past-main [on|off]'
          Set whether backtraces should continue past 'main'.  Related
          setting: set backtrace past-main.

     '-past-entry [on|off]'
          Set whether backtraces should continue past the entry point of
          a program.  Related setting: set backtrace past-entry.

     '-entry-values no|only|preferred|if-needed|both|compact|default'
          Set printing of function arguments at function entry.  Related
          setting: set print entry-values.

     '-frame-arguments all|scalars|none'
          Set printing of non-scalar frame arguments.  Related setting:
          set print frame-arguments.

     '-raw-frame-arguments [on|off]'
          Set whether to print frame arguments in raw form.  Related
          setting: set print raw-frame-arguments.

     '-frame-info auto|source-line|location|source-and-location|location-and-address|short-location'
          Set printing of frame information.  Related setting: set print frame-info.

     The optional QUALIFIER is maintained for backward compatibility.
     It can be one of the following:

     'full'
          Equivalent to the '-full' option.

     'no-filters'
          Equivalent to the '-no-filters' option.

     'hide'
          Equivalent to the '-hide' option.

   The names 'where' and 'info stack' (abbreviated 'info s') are
additional aliases for 'backtrace'.

   In a multi-threaded program, GDB by default shows the backtrace only
for the current thread.  To display the backtrace for several or all of
the threads, use the command 'thread apply' (see thread apply).
For example, if you type 'thread apply all backtrace', GDB
will display the backtrace for all the threads; this is handy when you
debug a core dump of a multi-threaded program.

   Each line in the backtrace shows the frame number and the function
name.  The program counter value is also shown--unless you use 'set
print address off'.  The backtrace also shows the source file name and
line number, as well as the arguments to the function.  The program
counter value is omitted if it is at the beginning of the code for that
line number.

   Here is an example of a backtrace.  It was made with the command 'bt
3', so it shows the innermost three frames.

     #0  m4_traceon (obs=0x24eb0, argc=1, argv=0x2b8c8)
         at builtin.c:993
     #1  0x6e38 in expand_macro (sym=0x2b600, data=...) at macro.c:242
     #2  0x6840 in expand_token (obs=0x0, t=177664, td=0xf7fffb08)
         at macro.c:71
     (More stack frames follow...)

The display for frame zero does not begin with a program counter value,
indicating that your program has stopped at the beginning of the code
for line '993' of 'builtin.c'.

The value of parameter 'data' in frame 1 has been replaced by '...'.  By
default, GDB prints the value of a parameter only if it is a scalar
(integer, pointer, enumeration, etc).  See command 'set print
frame-arguments' in Print Settings for more details on how to
configure the way function parameter values are printed.  The command
'set print frame-info' (see Print Settings) controls what frame
information is printed.

   If your program was compiled with optimizations, some compilers will
optimize away arguments passed to functions if those arguments are never
used after the call.  Such optimizations generate code that passes
arguments through registers, but doesn't store those arguments in the
stack frame.  GDB has no way of displaying such arguments in stack
frames other than the innermost one.  Here's what such a backtrace might
look like:

     #0  m4_traceon (obs=0x24eb0, argc=1, argv=0x2b8c8)
         at builtin.c:993
     #1  0x6e38 in expand_macro (sym=<optimized out>) at macro.c:242
     #2  0x6840 in expand_token (obs=0x0, t=<optimized out>, td=0xf7fffb08)
         at macro.c:71
     (More stack frames follow...)

The values of arguments that were not saved in their stack frames are
shown as '<optimized out>'.

   If you need to display the values of such optimized-out arguments,
either deduce that from other variables whose values depend on the one
you are interested in, or recompile without optimizations.

   Most programs have a standard user entry point--a place where system
libraries and startup code transition into user code.  For C this is
'main'(1).  When GDB finds the entry function in a backtrace it will
terminate the backtrace, to avoid tracing into highly system-specific
(and generally uninteresting) code.

   If you need to examine the startup code, or limit the number of
levels in a backtrace, you can change this behavior:

'set backtrace past-main'
'set backtrace past-main on'
     Backtraces will continue past the user entry point.

'set backtrace past-main off'
     Backtraces will stop when they encounter the user entry point.
     This is the default.

'show backtrace past-main'
     Display the current user entry point backtrace policy.

'set backtrace past-entry'
'set backtrace past-entry on'
     Backtraces will continue past the internal entry point of an
     application.  This entry point is encoded by the linker when the
     application is built, and is likely before the user entry point
     'main' (or equivalent) is called.

'set backtrace past-entry off'
     Backtraces will stop when they encounter the internal entry point
     of an application.  This is the default.

'show backtrace past-entry'
     Display the current internal entry point backtrace policy.

'set backtrace limit N'
'set backtrace limit 0'
'set backtrace limit unlimited'
     Limit the backtrace to N levels.  A value of 'unlimited' or zero
     means unlimited levels.

'show backtrace limit'
     Display the current limit on backtrace levels.

   You can control how file names are displayed.

'set filename-display'
'set filename-display relative'
     Display file names relative to the compilation directory.  This is
     the default.

'set filename-display basename'
     Display only basename of a filename.

'set filename-display absolute'
     Display an absolute filename.

'show filename-display'
     Show the current way to display filenames.

   ---------- Footnotes ----------

   (1) Note that embedded programs (the so-called "free-standing"
environment) are not required to have a 'main' function as the entry
point.  They could even have multiple entry points.

8.3 Selecting a Frame
=====================

Most commands for examining the stack and other data in your program
work on whichever stack frame is selected at the moment.  Here are the
commands for selecting a stack frame; all of them finish by printing a
brief description of the stack frame just selected.

'frame [ FRAME-SELECTION-SPEC ]'
'f [ FRAME-SELECTION-SPEC ]'
     The 'frame' command allows different stack frames to be selected.
     The FRAME-SELECTION-SPEC can be any of the following:

     'NUM'
     'level NUM'
          Select frame level NUM.  Recall that frame zero is the
          innermost (currently executing) frame, frame one is the frame
          that called the innermost one, and so on.  The highest level
          frame is usually the one for 'main'.

          As this is the most common method of navigating the frame
          stack, the string 'level' can be omitted.  For example, the
          following two commands are equivalent:

               (gdb) frame 3
               (gdb) frame level 3

     'address STACK-ADDRESS'
          Select the frame with stack address STACK-ADDRESS.  The
          STACK-ADDRESS for a frame can be seen in the output of 'info
          frame', for example:

               (gdb) info frame
               Stack level 1, frame at 0x7fffffffda30:
                rip = 0x40066d in b (amd64-entry-value.cc:59); saved rip 0x4004c5
                tail call frame, caller of frame at 0x7fffffffda30
                source language c++.
                Arglist at unknown address.
                Locals at unknown address, Previous frame's sp is 0x7fffffffda30

          The STACK-ADDRESS for this frame is '0x7fffffffda30' as
          indicated by the line:

               Stack level 1, frame at 0x7fffffffda30:

     'function FUNCTION-NAME'
          Select the stack frame for function FUNCTION-NAME.  If there
          are multiple stack frames for function FUNCTION-NAME then the
          inner most stack frame is selected.

     'view STACK-ADDRESS [ PC-ADDR ]'
          View a frame that is not part of GDB's backtrace.  The frame
          viewed has stack address STACK-ADDR, and optionally, a program
          counter address of PC-ADDR.

          This is useful mainly if the chaining of stack frames has been
          damaged by a bug, making it impossible for GDB to assign
          numbers properly to all frames.  In addition, this can be
          useful when your program has multiple stacks and switches
          between them.

          When viewing a frame outside the current backtrace using
          'frame view' then you can always return to the original stack
          using one of the previous stack frame selection instructions,
          for example 'frame level 0'.

'up N'
     Move N frames up the stack; N defaults to 1.  For positive numbers
     N, this advances toward the outermost frame, to higher frame
     numbers, to frames that have existed longer.

'down N'
     Move N frames down the stack; N defaults to 1.  For positive
     numbers N, this advances toward the innermost frame, to lower frame
     numbers, to frames that were created more recently.  You may
     abbreviate 'down' as 'do'.

   All of these commands end by printing two lines of output describing
the frame.  The first line shows the frame number, the function name,
the arguments, and the source file and line number of execution in that
frame.  The second line shows the text of that source line.

   For example:

     (gdb) up
     #1  0x22f0 in main (argc=1, argv=0xf7fffbf4, env=0xf7fffbfc)
         at env.c:10
     10              read_input_file (argv[i]);

   After such a printout, the 'list' command with no arguments prints
ten lines centered on the point of execution in the frame.  You can also
edit the program at the point of execution with your favorite editing
program by typing 'edit'.  See Printing Source Lines, for
details.

'select-frame [ FRAME-SELECTION-SPEC ]'
     The 'select-frame' command is a variant of 'frame' that does not
     display the new frame after selecting it.  This command is intended
     primarily for use in GDB command scripts, where the output might be
     unnecessary and distracting.  The FRAME-SELECTION-SPEC is as for
     the 'frame' command described in Selecting a Frame.

'up-silently N'
'down-silently N'
     These two commands are variants of 'up' and 'down', respectively;
     they differ in that they do their work silently, without causing
     display of the new frame.  They are intended primarily for use in
     GDB command scripts, where the output might be unnecessary and
     distracting.

8.4 Information About a Frame
=============================

There are several other commands to print information about the selected
stack frame.

'frame'
'f'
     When used without any argument, this command does not change which
     frame is selected, but prints a brief description of the currently
     selected stack frame.  It can be abbreviated 'f'.  With an
     argument, this command is used to select a stack frame.  See
     Selecting a Frame.

'info frame'
'info f'
     This command prints a verbose description of the selected stack
     frame, including:

        * the address of the frame
        * the address of the next frame down (called by this frame)
        * the address of the next frame up (caller of this frame)
        * the language in which the source code corresponding to this
          frame is written
        * the address of the frame's arguments
        * the address of the frame's local variables
        * the program counter saved in it (the address of execution in
          the caller frame)
        * which registers were saved in the frame

     The verbose description is useful when something has gone wrong
     that has made the stack format fail to fit the usual conventions.

'info frame [ FRAME-SELECTION-SPEC ]'
'info f [ FRAME-SELECTION-SPEC ]'
     Print a verbose description of the frame selected by
     FRAME-SELECTION-SPEC.  The FRAME-SELECTION-SPEC is the same as for
     the 'frame' command (see Selecting a Frame).  The
     selected frame remains unchanged by this command.

'info args [-q]'
     Print the arguments of the selected frame, each on a separate line.

     The optional flag '-q', which stands for 'quiet', disables printing
     header information and messages explaining why no argument have
     been printed.

'info args [-q] [-t TYPE_REGEXP] [REGEXP]'
     Like 'info args', but only print the arguments selected with the
     provided regexp(s).

     If REGEXP is provided, print only the arguments whose names match
     the regular expression REGEXP.

     If TYPE_REGEXP is provided, print only the arguments whose types,
     as printed by the 'whatis' command, match the regular expression
     TYPE_REGEXP.  If TYPE_REGEXP contains space(s), it should be
     enclosed in quote characters.  If needed, use backslash to escape
     the meaning of special characters or quotes.

     If both REGEXP and TYPE_REGEXP are provided, an argument is printed
     only if its name matches REGEXP and its type matches TYPE_REGEXP.

'info locals [-q]'
     Print the local variables of the selected frame, each on a separate
     line.  These are all variables (declared either static or
     automatic) accessible at the point of execution of the selected
     frame.

     The optional flag '-q', which stands for 'quiet', disables printing
     header information and messages explaining why no local variables
     have been printed.

'info locals [-q] [-t TYPE_REGEXP] [REGEXP]'
     Like 'info locals', but only print the local variables selected
     with the provided regexp(s).

     If REGEXP is provided, print only the local variables whose names
     match the regular expression REGEXP.

     If TYPE_REGEXP is provided, print only the local variables whose
     types, as printed by the 'whatis' command, match the regular
     expression TYPE_REGEXP.  If TYPE_REGEXP contains space(s), it
     should be enclosed in quote characters.  If needed, use backslash
     to escape the meaning of special characters or quotes.

     If both REGEXP and TYPE_REGEXP are provided, a local variable is
     printed only if its name matches REGEXP and its type matches
     TYPE_REGEXP.

     The command 'info locals -q -t TYPE_REGEXP' can usefully be
     combined with the commands 'frame apply' and 'thread apply'.  For
     example, your program might use Resource Acquisition Is
     Initialization types (RAII) such as 'lock_something_t': each local
     variable of type 'lock_something_t' automatically places a lock
     that is destroyed when the variable goes out of scope.  You can
     then list all acquired locks in your program by doing
          thread apply all -s frame apply all -s info locals -q -t lock_something_t
     or the equivalent shorter form
          tfaas i lo -q -t lock_something_t

8.5 Applying a Command to Several Frames.
=========================================

'frame apply [all | COUNT | -COUNT | level LEVEL...] [OPTION]... COMMAND'
     The 'frame apply' command allows you to apply the named COMMAND to
     one or more frames.

     'all'
          Specify 'all' to apply COMMAND to all frames.

     'COUNT'
          Use COUNT to apply COMMAND to the innermost COUNT frames,
          where COUNT is a positive number.

     '-COUNT'
          Use -COUNT to apply COMMAND to the outermost COUNT frames,
          where COUNT is a positive number.

     'level'
          Use 'level' to apply COMMAND to the set of frames identified
          by the LEVEL list.  LEVEL is a frame level or a range of frame
          levels as LEVEL1-LEVEL2.  The frame level is the number shown
          in the first field of the 'backtrace' command output.  E.g.,
          '2-4 6-8 3' indicates to apply COMMAND for the frames at
          levels 2, 3, 4, 6, 7, 8, and then again on frame at level 3.

     Note that the frames on which 'frame apply' applies a command are
     also influenced by the 'set backtrace' settings such as 'set
     backtrace past-main' and 'set backtrace limit N'.  See
     Backtraces.

     The 'frame apply' command also supports a number of options that
     allow overriding relevant 'set backtrace' settings:

     '-past-main [on|off]'
          Whether backtraces should continue past 'main'.  Related
          setting: set backtrace past-main.

     '-past-entry [on|off]'
          Whether backtraces should continue past the entry point of a
          program.  Related setting: set backtrace past-entry.

     By default, GDB displays some frame information before the output
     produced by COMMAND, and an error raised during the execution of a
     COMMAND will abort 'frame apply'.  The following options can be
     used to fine-tune these behaviors:

     '-c'
          The flag '-c', which stands for 'continue', causes any errors
          in COMMAND to be displayed, and the execution of 'frame apply'
          then continues.
     '-s'
          The flag '-s', which stands for 'silent', causes any errors or
          empty output produced by a COMMAND to be silently ignored.
          That is, the execution continues, but the frame information
          and errors are not printed.
     '-q'
          The flag '-q' ('quiet') disables printing the frame
          information.

     The following example shows how the flags '-c' and '-s' are working
     when applying the command 'p j' to all frames, where variable 'j'
     can only be successfully printed in the outermost '#1 main' frame.

          (gdb) frame apply all p j
          #0  some_function (i=5) at fun.c:4
          No symbol "j" in current context.
          (gdb) frame apply all -c p j
          #0  some_function (i=5) at fun.c:4
          No symbol "j" in current context.
          #1  0x565555fb in main (argc=1, argv=0xffffd2c4) at fun.c:11
          $1 = 5
          (gdb) frame apply all -s p j
          #1  0x565555fb in main (argc=1, argv=0xffffd2c4) at fun.c:11
          $2 = 5
          (gdb)

     By default, 'frame apply', prints the frame location information
     before the command output:

          (gdb) frame apply all p $sp
          #0  some_function (i=5) at fun.c:4
          $4 = (void *) 0xffffd1e0
          #1  0x565555fb in main (argc=1, argv=0xffffd2c4) at fun.c:11
          $5 = (void *) 0xffffd1f0
          (gdb)

     If the flag '-q' is given, no frame information is printed:
          (gdb) frame apply all -q p $sp
          $12 = (void *) 0xffffd1e0
          $13 = (void *) 0xffffd1f0
          (gdb)

'faas COMMAND'
     Shortcut for 'frame apply all -s COMMAND'.  Applies COMMAND on all
     frames, ignoring errors and empty output.

     It can for example be used to print a local variable or a function
     argument without knowing the frame where this variable or argument
     is, using:
          (gdb) faas p some_local_var_i_do_not_remember_where_it_is

     The 'faas' command accepts the same options as the 'frame apply'
     command.  See frame apply.

     Note that the command 'tfaas COMMAND' applies COMMAND on all frames
     of all threads.  See Threads.

8.6 Management of Frame Filters.
================================

Frame filters are Python based utilities to manage and decorate the
output of frames.  See Frame Filter API, for further information.

   Managing frame filters is performed by several commands available
within GDB, detailed here.

'info frame-filter'
     Print a list of installed frame filters from all dictionaries,
     showing their name, priority and enabled status.

'disable frame-filter FILTER-DICTIONARY FILTER-NAME'
     Disable a frame filter in the dictionary matching FILTER-DICTIONARY
     and FILTER-NAME.  The FILTER-DICTIONARY may be 'all', 'global',
     'progspace', or the name of the object file where the frame filter
     dictionary resides.  When 'all' is specified, all frame filters
     across all dictionaries are disabled.  The FILTER-NAME is the name
     of the frame filter and is used when 'all' is not the option for
     FILTER-DICTIONARY.  A disabled frame-filter is not deleted, it may
     be enabled again later.

'enable frame-filter FILTER-DICTIONARY FILTER-NAME'
     Enable a frame filter in the dictionary matching FILTER-DICTIONARY
     and FILTER-NAME.  The FILTER-DICTIONARY may be 'all', 'global',
     'progspace' or the name of the object file where the frame filter
     dictionary resides.  When 'all' is specified, all frame filters
     across all dictionaries are enabled.  The FILTER-NAME is the name
     of the frame filter and is used when 'all' is not the option for
     FILTER-DICTIONARY.

     Example:

          (gdb) info frame-filter

          global frame-filters:
            Priority  Enabled  Name
            1000      No       PrimaryFunctionFilter
            100       Yes      Reverse

          progspace /build/test frame-filters:
            Priority  Enabled  Name
            100       Yes      ProgspaceFilter

          objfile /build/test frame-filters:
            Priority  Enabled  Name
            999       Yes      BuildProgramFilter

          (gdb) disable frame-filter /build/test BuildProgramFilter
          (gdb) info frame-filter

          global frame-filters:
            Priority  Enabled  Name
            1000      No       PrimaryFunctionFilter
            100       Yes      Reverse

          progspace /build/test frame-filters:
            Priority  Enabled  Name
            100       Yes      ProgspaceFilter

          objfile /build/test frame-filters:
            Priority  Enabled  Name
            999       No       BuildProgramFilter

          (gdb) enable frame-filter global PrimaryFunctionFilter
          (gdb) info frame-filter

          global frame-filters:
            Priority  Enabled  Name
            1000      Yes      PrimaryFunctionFilter
            100       Yes      Reverse

          progspace /build/test frame-filters:
            Priority  Enabled  Name
            100       Yes      ProgspaceFilter

          objfile /build/test frame-filters:
            Priority  Enabled  Name
            999       No       BuildProgramFilter

'set frame-filter priority FILTER-DICTIONARY FILTER-NAME PRIORITY'
     Set the PRIORITY of a frame filter in the dictionary matching
     FILTER-DICTIONARY, and the frame filter name matching FILTER-NAME.
     The FILTER-DICTIONARY may be 'global', 'progspace' or the name of
     the object file where the frame filter dictionary resides.  The
     PRIORITY is an integer.

'show frame-filter priority FILTER-DICTIONARY FILTER-NAME'
     Show the PRIORITY of a frame filter in the dictionary matching
     FILTER-DICTIONARY, and the frame filter name matching FILTER-NAME.
     The FILTER-DICTIONARY may be 'global', 'progspace' or the name of
     the object file where the frame filter dictionary resides.

     Example:

          (gdb) info frame-filter

          global frame-filters:
            Priority  Enabled  Name
            1000      Yes      PrimaryFunctionFilter
            100       Yes      Reverse

          progspace /build/test frame-filters:
            Priority  Enabled  Name
            100       Yes      ProgspaceFilter

          objfile /build/test frame-filters:
            Priority  Enabled  Name
            999       No       BuildProgramFilter

          (gdb) set frame-filter priority global Reverse 50
          (gdb) info frame-filter

          global frame-filters:
            Priority  Enabled  Name
            1000      Yes      PrimaryFunctionFilter
            50        Yes      Reverse

          progspace /build/test frame-filters:
            Priority  Enabled  Name
            100       Yes      ProgspaceFilter

          objfile /build/test frame-filters:
            Priority  Enabled  Name
            999       No       BuildProgramFilter

9 Examining Source Files
************************

GDB can print parts of your program's source, since the debugging
information recorded in the program tells GDB what source files were
used to build it.  When your program stops, GDB spontaneously prints the
line where it stopped.  Likewise, when you select a stack frame (see
Selecting a Frame), GDB prints the line where execution in
that frame has stopped.  You can print other portions of source files by
explicit command.

   If you use GDB through its GNU Emacs interface, you may prefer to use
Emacs facilities to view source; see Using GDB under GNU Emacs.

9.1 Printing Source Lines
=========================

To print lines from a source file, use the 'list' command (abbreviated
'l').  By default, ten lines are printed.  There are several ways to
specify what part of the file you want to print; see Location Specifications,
for the full list.

   Here are the forms of the 'list' command most commonly used:

'list LINENUM'
     Print lines centered around line number LINENUM in the current
     source file.

'list FUNCTION'
     Print lines centered around the beginning of function FUNCTION.

'list'
     Print more lines.  If the last lines printed were printed with a
     'list' command, this prints lines following the last lines printed;
     however, if the last line printed was a solitary line printed as
     part of displaying a stack frame (see Examining the Stack),
     this prints lines centered around that line.  If no 'list'
     command has been used and no solitary line was printed, it prints
     the lines around the function 'main'.

'list +'
     Same as using with no arguments.

'list -'
     Print lines just before the lines last printed.

'list .'
     Print the lines surrounding the point of execution within the
     currently selected frame.  If the inferior is not running, print
     lines around the start of the main function instead.

   By default, GDB prints ten source lines with any of these forms of
the 'list' command.  You can change this using 'set listsize':

'set listsize COUNT'
'set listsize unlimited'
     Make the 'list' command display COUNT source lines (unless the
     'list' argument explicitly specifies some other number).  Setting
     COUNT to 'unlimited' or 0 means there's no limit.

'show listsize'
     Display the number of lines that 'list' prints.

   Repeating a 'list' command with <RET> discards the argument, so it is
equivalent to typing just 'list'.  This is more useful than listing the
same lines again.  An exception is made for an argument of '-'; that
argument is preserved in repetition so that each repetition moves up in
the source file.

   In general, the 'list' command expects you to supply zero, one or two
location specs.  These location specs are interpreted to resolve to
source code lines; there are several ways of writing them (see
Location Specifications), but the effect is always to resolve to some
source lines to display.

   Here is a complete description of the possible arguments for 'list':

'list LOCSPEC'
     Print lines centered around the line or lines of all the code
     locations that result from resolving LOCSPEC.

'list FIRST,LAST'
     Print lines from FIRST to LAST.  Both arguments are location specs.
     When a 'list' command has two location specs, and the source file
     of the second location spec is omitted, this refers to the same
     source file as the first location spec.  If either FIRST or LAST
     resolve to more than one source line in the program, then the list
     command shows the list of resolved source lines and does not
     proceed with the source code listing.

'list ,LAST'
     Print lines ending with LAST.

     Likewise, if LAST resolves to more than one source line in the
     program, then the list command prints the list of resolved source
     lines and does not proceed with the source code listing.

'list FIRST,'
     Print lines starting with FIRST.

'list +'
     Print lines just after the lines last printed.

'list -'
     Print lines just before the lines last printed.

'list'
     As described in the preceding table.

9.2 Location Specifications
===========================

Several GDB commands accept arguments that specify a location or
locations of your program's code.  Many times locations are specified
using a source line number, but they can also be specified by a function
name, an address, a label, etc.  The different forms of specifying a
location that GDB recognizes are collectively known as forms of
"location specification", or "location spec".  This section documents
the forms of specifying locations that GDB recognizes.

   When you specify a location, GDB needs to find the place in your
program, known as "code location", that corresponds to the given
location spec.  We call this process of finding actual code locations
corresponding to a location spec "location resolution".

   A concrete code location in your program is uniquely identifiable by
a set of several attributes: its source line number, the name of its
source file, the fully-qualified and prototyped function in which it is
defined, and an instruction address.  Because each inferior has its own
address space, the inferior number is also a necessary part of these
attributes.

   By contrast, location specs you type will many times omit some of
these attributes.  For example, it is customary to specify just the
source line number to mean a line in the current source file, or specify
just the basename of the file, omitting its directories.  In other
words, a location spec is usually incomplete, a kind of blueprint, and
GDB needs to complete the missing attributes by using the implied
defaults, and by considering the source code and the debug information
available to it.  This is what location resolution is about.

   The resolution of an incomplete location spec can produce more than a
single code location, if the spec doesn't allow distinguishing between
them.  Here are some examples of situations that result in a location
spec matching multiple code locations in your program:

   * The location spec specifies a function name, and there are several
     functions in the program which have that name.  (To distinguish
     between them, you can specify a fully-qualified and prototyped
     function name, such as 'A::func(int)' instead of just 'func'.)

   * The location spec specifies a source file name, and there are
     several source files in the program that share the same name, for
     example several files with the same basename in different
     subdirectories.  (To distinguish between them, specify enough
     leading directories with the file name.)

   * For a C++ constructor, the GCC compiler generates several instances
     of the function body, used in different cases, but their
     source-level names are identical.

   * For a C++ template function, a given line in the function can
     correspond to any number of instantiations.

   * For an inlined function, a given source line can correspond to
     several actual code locations with that function's inlined code.

   Resolution of a location spec can also fail to produce a complete
code location, or even fail to produce any code location.  Here are some
examples of such situations:

   * Some parts of the program lack detailed enough debug info, so the
     resolved code location lacks some attributes, like source file name
     and line number, leaving just the instruction address and perhaps
     also a function name.  Such an incomplete code location is only
     usable in contexts that work with addresses and/or function names.
     Some commands can only work with complete code locations.

   * The location spec specifies a function name, and there are no
     functions in the program by that name, or they only exist in a
     yet-unloaded shared library.

   * The location spec specifies a source file name, and there are no
     source files in the program by that name, or they only exist in a
     yet-unloaded shared library.

   * The location spec specifies both a source file name and a source
     line number, and even though there are source files in the program
     that match the file name, none of those files has the specified
     line number.

   Locations may be specified using three different formats: linespec
locations, explicit locations, or address locations.  The following
subsections describe these formats.

9.2.1 Linespec Locations
------------------------

A "linespec" is a colon-separated list of source location parameters
such as file name, function name, etc.  Here are all the different ways
of specifying a linespec:

'LINENUM'
     Specifies the line number LINENUM of the current source file.

'-OFFSET'
'+OFFSET'
     Specifies the line OFFSET lines before or after the "current line".
     For the 'list' command, the current line is the last one printed;
     for the breakpoint commands, this is the line at which execution
     stopped in the currently selected "stack frame" (see Frames,
     for a description of stack frames.)  When used as the
     second of the two linespecs in a 'list' command, this specifies the
     line OFFSET lines up or down from the first linespec.

'FILENAME:LINENUM'
     Specifies the line LINENUM in the source file FILENAME.  If
     FILENAME is a relative file name, then it will match any source
     file name with the same trailing components.  For example, if
     FILENAME is 'gcc/expr.c', then it will match source file name of
     '/build/trunk/gcc/expr.c', but not '/build/trunk/libcpp/expr.c' or
     '/build/trunk/gcc/x-expr.c'.

'FUNCTION'
     Specifies the line that begins the body of the function FUNCTION.
     For example, in C, this is the line with the open brace.

     By default, in C++ and Ada, FUNCTION is interpreted as specifying
     all functions named FUNCTION in all scopes.  For C++, this means in
     all namespaces and classes.  For Ada, this means in all packages.

     For example, assuming a program with C++ symbols named 'A::B::func'
     and 'B::func', both commands 'break func' and 'break B::func' set a
     breakpoint on both symbols.

     Commands that accept a linespec let you override this with the
     '-qualified' option.  For example, 'break -qualified func' sets a
     breakpoint on a free-function named 'func' ignoring any C++ class
     methods and namespace functions called 'func'.

     See Explicit Locations.

'FUNCTION:LABEL'
     Specifies the line where LABEL appears in FUNCTION.

'FILENAME:FUNCTION'
     Specifies the line that begins the body of the function FUNCTION in
     the file FILENAME.  You only need the file name with a function
     name to avoid ambiguity when there are identically named functions
     in different source files.

'LABEL'
     Specifies the line at which the label named LABEL appears in the
     function corresponding to the currently selected stack frame.  If
     there is no current selected stack frame (for instance, if the
     inferior is not running), then GDB will not search for a label.

'-pstap|-probe-stap [OBJFILE:[PROVIDER:]]NAME'
     The GNU/Linux tool 'SystemTap' provides a way for applications to
     embed static probes.  See Static Probe Points, for more
     information on finding and using static probes.  This form of
     linespec specifies the location of such a static probe.

     If OBJFILE is given, only probes coming from that shared library or
     executable matching OBJFILE as a regular expression are considered.
     If PROVIDER is given, then only probes from that provider are
     considered.  If several probes match the spec, GDB will insert a
     breakpoint at each one of those probes.

9.2.2 Explicit Locations
------------------------

"Explicit locations" allow the user to directly specify the source
location's parameters using option-value pairs.

   Explicit locations are useful when several functions, labels, or file
names have the same name (base name for files) in the program's sources.
In these cases, explicit locations point to the source line you meant
more accurately and unambiguously.  Also, using explicit locations might
be faster in large programs.

   For example, the linespec 'foo:bar' may refer to a function 'bar'
defined in the file named 'foo' or the label 'bar' in a function named
'foo'.  GDB must search either the file system or the symbol table to
know.

   The list of valid explicit location options is summarized in the
following table:

'-source FILENAME'
     The value specifies the source file name.  To differentiate between
     files with the same base name, prepend as many directories as is
     necessary to uniquely identify the desired file, e.g.,
     'foo/bar/baz.c'.  Otherwise GDB will use the first file it finds
     with the given base name.  This option requires the use of either
     '-function' or '-line'.

'-function FUNCTION'
     The value specifies the name of a function.  Operations on function
     locations unmodified by other options (such as '-label' or '-line')
     refer to the line that begins the body of the function.  In C, for
     example, this is the line with the open brace.

     By default, in C++ and Ada, FUNCTION is interpreted as specifying
     all functions named FUNCTION in all scopes.  For C++, this means in
     all namespaces and classes.  For Ada, this means in all packages.

     For example, assuming a program with C++ symbols named 'A::B::func'
     and 'B::func', both commands 'break -function func' and
     'break -function B::func' set a breakpoint on both symbols.

     You can use the '-qualified' flag to override this (see below).

'-qualified'

     This flag makes GDB interpret a function name specified with
     '-function' as a complete fully-qualified name.

     For example, assuming a C++ program with symbols named 'A::B::func'
     and 'B::func', the 'break -qualified -function B::func' command
     sets a breakpoint on 'B::func', only.

     (Note: the '-qualified' option can precede a linespec as well
     (see Linespec Locations), so the particular example above could
     be simplified as 'break -qualified B::func'.)

'-label LABEL'
     The value specifies the name of a label.  When the function name is
     not specified, the label is searched in the function of the
     currently selected stack frame.

'-line NUMBER'
     The value specifies a line offset for the location.  The offset may
     either be absolute ('-line 3') or relative ('-line +3'), depending
     on the command.  When specified without any other options, the line
     offset is relative to the current line.

   Explicit location options may be abbreviated by omitting any
non-unique trailing characters from the option name, e.g.,
'break -s main.c -li 3'.

9.2.3 Address Locations
-----------------------

"Address locations" indicate a specific program address.  They have the
generalized form *ADDRESS.

   For line-oriented commands, such as 'list' and 'edit', this specifies
a source line that contains ADDRESS.  For 'break' and other
breakpoint-oriented commands, this can be used to set breakpoints in
parts of your program which do not have debugging information or source
files.

   Here ADDRESS may be any expression valid in the current working
language (see working language) that specifies a code
address.  In addition, as a convenience, GDB extends the semantics of
expressions used in locations to cover several situations that
frequently occur during debugging.  Here are the various forms of
ADDRESS:

'EXPRESSION'
     Any expression valid in the current working language.

'FUNCADDR'
     An address of a function or procedure derived from its name.  In C,
     C++, Objective-C, Fortran, minimal, and assembly, this is simply
     the function's name FUNCTION (and actually a special case of a
     valid expression).  In Pascal and Modula-2, this is '&FUNCTION'.
     In Ada, this is 'FUNCTION'Address' (although the Pascal form also
     works).

     This form specifies the address of the function's first
     instruction, before the stack frame and arguments have been set up.

''FILENAME':FUNCADDR'
     Like FUNCADDR above, but also specifies the name of the source file
     explicitly.  This is useful if the name of the function does not
     specify the function unambiguously, e.g., if there are several
     functions with identical names in different source files.

9.3 Editing Source Files
========================

To edit the lines in a source file, use the 'edit' command.  The editing
program of your choice is invoked with the current line set to the
active line in the program.  Alternatively, there are several ways to
specify what part of the file you want to print if you want to see other
parts of the program:

'edit LOCSPEC'
     Edit the source file of the code location that results from
     resolving 'locspec'.  Editing starts at the source file and source
     line 'locspec' resolves to.  See Location Specifications, for
     all the possible forms of the LOCSPEC argument.

     If 'locspec' resolves to more than one source line in your program,
     then the command prints the list of resolved source lines and does
     not proceed with the editing.

     Here are the forms of the 'edit' command most commonly used:

     'edit NUMBER'
          Edit the current source file with NUMBER as the active line
          number.

     'edit FUNCTION'
          Edit the file containing FUNCTION at the beginning of its
          definition.

9.3.1 Choosing your Editor
--------------------------

You can customize GDB to use any editor you want (1).  By default, it is
'/bin/ex', but you can change this by setting the environment variable
'EDITOR' before using GDB.  For example, to configure GDB to use the
'vi' editor, you could use these commands with the 'sh' shell:
     EDITOR=/usr/bin/vi
     export EDITOR
     gdb ...
   or in the 'csh' shell,
     setenv EDITOR /usr/bin/vi
     gdb ...

   ---------- Footnotes ----------

   (1) The only restriction is that your editor (say 'ex'), recognizes
the following command-line syntax:
     ex +NUMBER file
   The optional numeric value +NUMBER specifies the number of the line
in the file where to start editing.

9.4 Searching Source Files
==========================

There are two commands for searching through the current source file for
a regular expression.

'forward-search REGEXP'
'search REGEXP'
     The command 'forward-search REGEXP' checks each line, starting with
     the one following the last line listed, for a match for REGEXP.  It
     lists the line that is found.  You can use the synonym 'search
     REGEXP' or abbreviate the command name as 'fo'.

'reverse-search REGEXP'
     The command 'reverse-search REGEXP' checks each line, starting with
     the one before the last line listed and going backward, for a match
     for REGEXP.  It lists the line that is found.  You can abbreviate
     this command as 'rev'.

9.5 Specifying Source Directories
=================================

Executable programs sometimes do not record the directories of the
source files from which they were compiled, just the names.  Even when
they do, the directories could be moved between the compilation and your
debugging session.  GDB has a list of directories to search for source
files; this is called the "source path".  Each time GDB wants a source
file, it tries all the directories in the list, in the order they are
present in the list, until it finds a file with the desired name.

   For example, suppose an executable references the file
'/usr/src/foo-1.0/lib/foo.c', does not record a compilation directory,
and the "source path" is '/mnt/cross'.  GDB would look for the source
file in the following locations:

  1. '/usr/src/foo-1.0/lib/foo.c'
  2. '/mnt/cross/usr/src/foo-1.0/lib/foo.c'
  3. '/mnt/cross/foo.c'

   If the source file is not present at any of the above locations then
an error is printed.  GDB does not look up the parts of the source file
name, such as '/mnt/cross/src/foo-1.0/lib/foo.c'.  Likewise, the
subdirectories of the source path are not searched: if the source path
is '/mnt/cross', and the binary refers to 'foo.c', GDB would not find it
under '/mnt/cross/usr/src/foo-1.0/lib'.

   Plain file names, relative file names with leading directories, file
names containing dots, etc. are all treated as described above, except
that non-absolute file names are not looked up literally.  If the
"source path" is '/mnt/cross', the source file is recorded as
'../lib/foo.c', and no compilation directory is recorded, then GDB will
search in the following locations:

  1. '/mnt/cross/../lib/foo.c'
  2. '/mnt/cross/foo.c'

   The "source path" will always include two special entries '$cdir' and
'$cwd', these refer to the compilation directory (if one is recorded)
and the current working directory respectively.

   '$cdir' causes GDB to search within the compilation directory, if one
is recorded in the debug information.  If no compilation directory is
recorded in the debug information then '$cdir' is ignored.

   '$cwd' is not the same as '.'--the former tracks the current working
directory as it changes during your GDB session, while the latter is
immediately expanded to the current directory at the time you add an
entry to the source path.

   If a compilation directory is recorded in the debug information, and
GDB has not found the source file after the first search using "source
path", then GDB will combine the compilation directory and the filename,
and then search for the source file again using the "source path".

   For example, if the executable records the source file as
'/usr/src/foo-1.0/lib/foo.c', the compilation directory is recorded as
'/project/build', and the "source path" is '/mnt/cross:$cdir:$cwd' while
the current working directory of the GDB session is '/home/user', then
GDB will search for the source file in the following locations:

  1. '/usr/src/foo-1.0/lib/foo.c'
  2. '/mnt/cross/usr/src/foo-1.0/lib/foo.c'
  3. '/project/build/usr/src/foo-1.0/lib/foo.c'
  4. '/home/user/usr/src/foo-1.0/lib/foo.c'
  5. '/mnt/cross/project/build/usr/src/foo-1.0/lib/foo.c'
  6. '/project/build/project/build/usr/src/foo-1.0/lib/foo.c'
  7. '/home/user/project/build/usr/src/foo-1.0/lib/foo.c'
  8. '/mnt/cross/foo.c'
  9. '/project/build/foo.c'
  10. '/home/user/foo.c'

   If the file name in the previous example had been recorded in the
executable as a relative path rather than an absolute path, then the
first look up would not have occurred, but all of the remaining steps
would be similar.

   When searching for source files on MS-DOS and MS-Windows, where
absolute paths start with a drive letter (e.g. 'C:/project/foo.c'), GDB
will remove the drive letter from the file name before appending it to a
search directory from "source path"; for instance if the executable
references the source file 'C:/project/foo.c' and "source path" is set
to 'D:/mnt/cross', then GDB will search in the following locations for
the source file:

  1. 'C:/project/foo.c'
  2. 'D:/mnt/cross/project/foo.c'
  3. 'D:/mnt/cross/foo.c'

   Note that the executable search path is _not_ used to locate the
source files.

   Whenever you reset or rearrange the source path, GDB clears out any
information it has cached about where source files are found and where
each line is in the file.

   When you start GDB, its source path includes only '$cdir' and '$cwd',
in that order.  To add other directories, use the 'directory' command.

   The search path is used to find both program source files and GDB
script files (read using the '-command' option and 'source' command).

   In addition to the source path, GDB provides a set of commands that
manage a list of source path substitution rules.  A "substitution rule"
specifies how to rewrite source directories stored in the program's
debug information in case the sources were moved to a different
directory between compilation and debugging.  A rule is made of two
strings, the first specifying what needs to be rewritten in the path,
and the second specifying how it should be rewritten.  In set substitute-path,
we name these two parts FROM and TO respectively.
GDB does a simple string replacement of FROM with TO at the start of the
directory part of the source file name, and uses that result instead of
the original file name to look up the sources.

   Using the previous example, suppose the 'foo-1.0' tree has been moved
from '/usr/src' to '/mnt/cross', then you can tell GDB to replace
'/usr/src' in all source path names with '/mnt/cross'.  The first lookup
will then be '/mnt/cross/foo-1.0/lib/foo.c' in place of the original
location of '/usr/src/foo-1.0/lib/foo.c'.  To define a source path
substitution rule, use the 'set substitute-path' command (see set substitute-path).

   To avoid unexpected substitution results, a rule is applied only if
the FROM part of the directory name ends at a directory separator.  For
instance, a rule substituting '/usr/source' into '/mnt/cross' will be
applied to '/usr/source/foo-1.0' but not to '/usr/sourceware/foo-2.0'.
And because the substitution is applied only at the beginning of the
directory name, this rule will not be applied to
'/root/usr/source/baz.c' either.

   In many cases, you can achieve the same result using the 'directory'
command.  However, 'set substitute-path' can be more efficient in the
case where the sources are organized in a complex tree with multiple
subdirectories.  With the 'directory' command, you need to add each
subdirectory of your project.  If you moved the entire tree while
preserving its internal organization, then 'set substitute-path' allows
you to direct the debugger to all the sources with one single command.

   'set substitute-path' is also more than just a shortcut command.  The
source path is only used if the file at the original location no longer
exists.  On the other hand, 'set substitute-path' modifies the debugger
behavior to look at the rewritten location instead.  So, if for any
reason a source file that is not relevant to your executable is located
at the original location, a substitution rule is the only method
available to point GDB at the new location.

   You can configure a default source path substitution rule by
configuring GDB with the '--with-relocated-sources=DIR' option.  The DIR
should be the name of a directory under GDB's configured prefix (set
with '--prefix' or '--exec-prefix'), and directory names in debug
information under DIR will be adjusted automatically if the installed
GDB is moved to a new location.  This is useful if GDB, libraries or
executables with debug information and corresponding source code are
being moved together.

'directory DIRNAME ...'
'dir DIRNAME ...'
     Add directory DIRNAME to the front of the source path.  Several
     directory names may be given to this command, separated by ':' (';'
     on MS-DOS and MS-Windows, where ':' usually appears as part of
     absolute file names) or whitespace.  You may specify a directory
     that is already in the source path; this moves it forward, so GDB
     searches it sooner.

     The special strings '$cdir' (to refer to the compilation directory,
     if one is recorded), and '$cwd' (to refer to the current working
     directory) can also be included in the list of directories DIRNAME.
     Though these will already be in the source path they will be moved
     forward in the list so GDB searches them sooner.

'directory'
     Reset the source path to its default value ('$cdir:$cwd' on Unix
     systems).  This requires confirmation.

'set directories PATH-LIST'
     Set the source path to PATH-LIST.  '$cdir:$cwd' are added if
     missing.

'show directories'
     Print the source path: show which directories it contains.

'set substitute-path FROM TO'
     Define a source path substitution rule, and add it at the end of
     the current list of existing substitution rules.  If a rule with
     the same FROM was already defined, then the old rule is also
     deleted.

     For example, if the file '/foo/bar/baz.c' was moved to
     '/mnt/cross/baz.c', then the command

          (gdb) set substitute-path /foo/bar /mnt/cross

     will tell GDB to replace '/foo/bar' with '/mnt/cross', which will
     allow GDB to find the file 'baz.c' even though it was moved.

     In the case when more than one substitution rule have been defined,
     the rules are evaluated one by one in the order where they have
     been defined.  The first one matching, if any, is selected to
     perform the substitution.

     For instance, if we had entered the following commands:

          (gdb) set substitute-path /usr/src/include /mnt/include
          (gdb) set substitute-path /usr/src /mnt/src

     GDB would then rewrite '/usr/src/include/defs.h' into
     '/mnt/include/defs.h' by using the first rule.  However, it would
     use the second rule to rewrite '/usr/src/lib/foo.c' into
     '/mnt/src/lib/foo.c'.

'unset substitute-path [path]'
     If a path is specified, search the current list of substitution
     rules for a rule that would rewrite that path.  Delete that rule if
     found.  A warning is emitted by the debugger if no rule could be
     found.

     If no path is specified, then all substitution rules are deleted.

'show substitute-path [path]'
     If a path is specified, then print the source path substitution
     rule which would rewrite that path, if any.

     If no path is specified, then print all existing source path
     substitution rules.

   If your source path is cluttered with directories that are no longer
of interest, GDB may sometimes cause confusion by finding the wrong
versions of source.  You can correct the situation as follows:

  1. Use 'directory' with no argument to reset the source path to its
     default value.

  2. Use 'directory' with suitable arguments to reinstall the
     directories you want in the source path.  You can add all the
     directories in one command.

9.6 Source and Machine Code
===========================

You can use the command 'info line' to map source lines to program
addresses (and vice versa), and the command 'disassemble' to display a
range of addresses as machine instructions.  You can use the command
'set disassemble-next-line' to set whether to disassemble next source
line when execution stops.  When run under GNU Emacs mode, the 'info
line' command causes the arrow to point to the line specified.  Also,
'info line' prints addresses in symbolic form as well as hex.

'info line'
'info line LOCSPEC'
     Print the starting and ending addresses of the compiled code for
     the source lines of the code locations that result from resolving
     LOCSPEC.  See Location Specifications, for the various forms of
     LOCSPEC.  With no LOCSPEC, information about the current source
     line is printed.

   For example, we can use 'info line' to discover the location of the
object code for the first line of function 'm4_changequote':

     (gdb) info line m4_changequote
     Line 895 of "builtin.c" starts at pc 0x634c <m4_changequote> and \
             ends at 0x6350 <m4_changequote+4>.

We can also inquire, using '*ADDR' as the form for LOCSPEC, what source
line covers a particular address ADDR:
     (gdb) info line *0x63ff
     Line 926 of "builtin.c" starts at pc 0x63e4 <m4_changequote+152> and \
             ends at 0x6404 <m4_changequote+184>.

   After 'info line', the default address for the 'x' command is changed
to the starting address of the line, so that 'x/i' is sufficient to
begin examining the machine code (see Examining Memory).
Also, this address is saved as the value of the convenience variable
'$_' (see Convenience Variables).

   After 'info line', using 'info line' again without specifying a
location will display information about the next source line.

'disassemble'
'disassemble /m'
'disassemble /s'
'disassemble /r'
'disassemble /b'
     This specialized command dumps a range of memory as machine
     instructions.  It can also print mixed source+disassembly by
     specifying the '/m' or '/s' modifier and print the raw instructions
     in hex as well as in symbolic form by specifying the '/r' or '/b'
     modifier.

     Only one of '/m' and '/s' can be used, attempting to use both flag
     will give an error.

     Only one of '/r' and '/b' can be used, attempting to use both flag
     will give an error.

     The default memory range is the function surrounding the program
     counter of the selected frame.  A single argument to this command
     is a program counter value; GDB dumps the function surrounding this
     value.  When two arguments are given, they should be separated by a
     comma, possibly surrounded by whitespace.  The arguments specify a
     range of addresses to dump, in one of two forms:

     'START,END'
          the addresses from START (inclusive) to END (exclusive)
     'START,+LENGTH'
          the addresses from START (inclusive) to 'START+LENGTH'
          (exclusive).

     When 2 arguments are specified, the name of the function is also
     printed (since there could be several functions in the given
     range).

     The argument(s) can be any expression yielding a numeric value,
     such as '0x32c4', '&main+10' or '$pc - 8'.

     If the range of memory being disassembled contains current program
     counter, the instruction at that location is shown with a '=>'
     marker.

   The following example shows the disassembly of a range of addresses
of HP PA-RISC 2.0 code:

     (gdb) disas 0x32c4, 0x32e4
     Dump of assembler code from 0x32c4 to 0x32e4:
        0x32c4 <main+204>:      addil 0,dp
        0x32c8 <main+208>:      ldw 0x22c(sr0,r1),r26
        0x32cc <main+212>:      ldil 0x3000,r31
        0x32d0 <main+216>:      ble 0x3f8(sr4,r31)
        0x32d4 <main+220>:      ldo 0(r31),rp
        0x32d8 <main+224>:      addil -0x800,dp
        0x32dc <main+228>:      ldo 0x588(r1),r26
        0x32e0 <main+232>:      ldil 0x3000,r31
     End of assembler dump.

   The following two examples are for RISC-V, and demonstrates the
difference between the '/r' and '/b' modifiers.  First with '/b', the
bytes of the instruction are printed, in hex, in memory order:

     (gdb) disassemble /b 0x00010150,0x0001015c
     Dump of assembler code from 0x10150 to 0x1015c:
        0x00010150 <call_me+4>:      22 dc                 	sw	s0,56(sp)
        0x00010152 <call_me+6>:      80 00                 	addi	s0,sp,64
        0x00010154 <call_me+8>:      23 26 a4 fe           	sw	a0,-20(s0)
        0x00010158 <call_me+12>:     23 24 b4 fe           	sw	a1,-24(s0)
     End of assembler dump.

   In contrast, with '/r' the bytes of the instruction are displayed in
the instruction order, for RISC-V this means that the bytes have been
swapped to little-endian order:

     (gdb) disassemble /r 0x00010150,0x0001015c
     Dump of assembler code from 0x10150 to 0x1015c:
        0x00010150 <call_me+4>:      dc22              	sw	s0,56(sp)
        0x00010152 <call_me+6>:      0080              	addi	s0,sp,64
        0x00010154 <call_me+8>:      fea42623        	sw	a0,-20(s0)
        0x00010158 <call_me+12>:     feb42423        	sw	a1,-24(s0)
     End of assembler dump.

   Here is an example showing mixed source+assembly for Intel x86 with
'/m' or '/s', when the program is stopped just after function prologue
in a non-optimized function with no inline code.

     (gdb) disas /m main
     Dump of assembler code for function main:
     5       {
        0x08048330 <+0>:    push   %ebp
        0x08048331 <+1>:    mov    %esp,%ebp
        0x08048333 <+3>:    sub    $0x8,%esp
        0x08048336 <+6>:    and    $0xfffffff0,%esp
        0x08048339 <+9>:    sub    $0x10,%esp

     6         printf ("Hello.\n");
     => 0x0804833c <+12>:   movl   $0x8048440,(%esp)
        0x08048343 <+19>:   call   0x8048284 <puts@plt>

     7         return 0;
     8       }
        0x08048348 <+24>:   mov    $0x0,%eax
        0x0804834d <+29>:   leave
        0x0804834e <+30>:   ret

     End of assembler dump.

   The '/m' option is deprecated as its output is not useful when there
is either inlined code or re-ordered code.  The '/s' option is the
preferred choice.  Here is an example for AMD x86-64 showing the
difference between '/m' output and '/s' output.  This example has one
inline function defined in a header file, and the code is compiled with
'-O2' optimization.  Note how the '/m' output is missing the disassembly
of several instructions that are present in the '/s' output.

   'foo.h':

     int
     foo (int a)
     {
       if (a < 0)
         return a * 2;
       if (a == 0)
         return 1;
       return a + 10;
     }

   'foo.c':

     #include "foo.h"
     volatile int x, y;
     int
     main ()
     {
       x = foo (y);
       return 0;
     }

     (gdb) disas /m main
     Dump of assembler code for function main:
     5	{

     6	  x = foo (y);
        0x0000000000400400 <+0>:	mov    0x200c2e(%rip),%eax # 0x601034 <y>
        0x0000000000400417 <+23>:	mov    %eax,0x200c13(%rip) # 0x601030 <x>

     7	  return 0;
     8	}
        0x000000000040041d <+29>:	xor    %eax,%eax
        0x000000000040041f <+31>:	retq
        0x0000000000400420 <+32>:	add    %eax,%eax
        0x0000000000400422 <+34>:	jmp    0x400417 <main+23>

     End of assembler dump.
     (gdb) disas /s main
     Dump of assembler code for function main:
     foo.c:
     5	{
     6	  x = foo (y);
        0x0000000000400400 <+0>:	mov    0x200c2e(%rip),%eax # 0x601034 <y>

     foo.h:
     4	  if (a < 0)
        0x0000000000400406 <+6>:	test   %eax,%eax
        0x0000000000400408 <+8>:	js     0x400420 <main+32>

     6	  if (a == 0)
     7	    return 1;
     8	  return a + 10;
        0x000000000040040a <+10>:	lea    0xa(%rax),%edx
        0x000000000040040d <+13>:	test   %eax,%eax
        0x000000000040040f <+15>:	mov    $0x1,%eax
        0x0000000000400414 <+20>:	cmovne %edx,%eax

     foo.c:
     6	  x = foo (y);
        0x0000000000400417 <+23>:	mov    %eax,0x200c13(%rip) # 0x601030 <x>

     7	  return 0;
     8	}
        0x000000000040041d <+29>:	xor    %eax,%eax
        0x000000000040041f <+31>:	retq

     foo.h:
     5	    return a * 2;
        0x0000000000400420 <+32>:	add    %eax,%eax
        0x0000000000400422 <+34>:	jmp    0x400417 <main+23>
     End of assembler dump.

   Here is another example showing raw instructions in hex for AMD
x86-64,

     (gdb) disas /r 0x400281,+10
     Dump of assembler code from 0x400281 to 0x40028b:
        0x0000000000400281:  38 36  cmp    %dh,(%rsi)
        0x0000000000400283:  2d 36 34 2e 73 sub    $0x732e3436,%eax
        0x0000000000400288:  6f     outsl  %ds:(%rsi),(%dx)
        0x0000000000400289:  2e 32 00       xor    %cs:(%rax),%al
     End of assembler dump.

   Note that the 'disassemble' command's address arguments are specified
using expressions in your programming language (see Expressions),
not location specs (see Location Specifications).
So, for example, if you want to disassemble function 'bar' in file
'foo.c', you must type 'disassemble 'foo.c'::bar' and not 'disassemble
foo.c:bar'.

   Some architectures have more than one commonly-used set of
instruction mnemonics or other syntax.

   For programs that were dynamically linked and use shared libraries,
instructions that call functions or branch to locations in the shared
libraries might show a seemingly bogus location--it's actually a
location of the relocation table.  On some architectures, GDB might be
able to resolve these to actual function names.

'set disassembler-options OPTION1[,OPTION2...]'
     This command controls the passing of target specific information to
     the disassembler.  For a list of valid options, please refer to the
     '-M'/'--disassembler-options' section of the 'objdump' manual
     and/or the output of 'objdump --help' (see objdump (binutils)).
     The default value is the empty string.

     If it is necessary to specify more than one disassembler option,
     then multiple options can be placed together into a comma separated
     list.  Currently this command is only supported on targets ARC,
     ARM, MIPS, PowerPC and S/390.

'show disassembler-options'
     Show the current setting of the disassembler options.

'set disassembly-flavor INSTRUCTION-SET'
     Select the instruction set to use when disassembling the program
     via the 'disassemble' or 'x/i' commands.

     Currently this command is only defined for the Intel x86 family.
     You can set INSTRUCTION-SET to either 'intel' or 'att'.  The
     default is 'att', the AT&T flavor used by default by Unix
     assemblers for x86-based targets.

'show disassembly-flavor'
     Show the current setting of the disassembly flavor.

'set disassemble-next-line'
'show disassemble-next-line'
     Control whether or not GDB will disassemble the next source line or
     instruction when execution stops.  If ON, GDB will display
     disassembly of the next source line when execution of the program
     being debugged stops.  This is _in addition_ to displaying the
     source line itself, which GDB always does if possible.  If the next
     source line cannot be displayed for some reason (e.g., if GDB
     cannot find the source file, or there's no line info in the debug
     info), GDB will display disassembly of the next _instruction_
     instead of showing the next source line.  If AUTO, GDB will display
     disassembly of next instruction only if the source line cannot be
     displayed.  This setting causes GDB to display some feedback when
     you step through a function with no line info or whose source file
     is unavailable.  The default is OFF, which means never display the
     disassembly of the next line or instruction.

9.7 Disable Reading Source Code
===============================

In some cases it can be desirable to prevent GDB from accessing source
code files.  One case where this might be desirable is if the source
code files are located over a slow network connection.

   The following command can be used to control whether GDB should
access source code files or not:

'set source open [on|off]'
'show source open'
     When this option is 'on', which is the default, GDB will access
     source code files when needed, for example to print source lines
     when GDB stops, or in response to the 'list' command.

     When this option is 'off', GDB will not access source code files.

10 Examining Data
*****************

The usual way to examine data in your program is with the 'print'
command (abbreviated 'p'), or its synonym 'inspect'.  It evaluates and
prints the value of an expression of the language your program is
written in (see Using GDB with Different Languages).  It
may also print the expression using a Python-based pretty-printer (see
Pretty Printing).

'print [[OPTIONS] --] EXPR'
'print [[OPTIONS] --] /F EXPR'
     EXPR is an expression (in the source language).  By default the
     value of EXPR is printed in a format appropriate to its data type;
     you can choose a different format by specifying '/F', where F is a
     letter specifying the format; see Output Formats.

     The 'print' command supports a number of options that allow
     overriding relevant global print settings as set by 'set print'
     subcommands:

     '-address [on|off]'
          Set printing of addresses.  Related setting: set print address.

     '-array [on|off]'
          Pretty formatting of arrays.  Related setting: set print array.

     '-array-indexes [on|off]'
          Set printing of array indexes.  Related setting: set print array-indexes.

     '-characters NUMBER-OF-CHARACTERS|elements|unlimited'
          Set limit on string characters to print.  The value 'elements'
          causes the limit on array elements to print to be used.  The
          value 'unlimited' causes there to be no limit.  Related
          setting: set print characters.

     '-elements NUMBER-OF-ELEMENTS|unlimited'
          Set limit on array elements and optionally string characters
          to print.  See set print characters, and the
          '-characters' option above for when this option applies to
          strings.  The value 'unlimited' causes there to be no limit.
          See set print elements, for a related CLI command.

     '-max-depth DEPTH|unlimited'
          Set the threshold after which nested structures are replaced
          with ellipsis.  Related setting: set print max-depth.

     '-nibbles [on|off]'
          Set whether to print binary values in groups of four bits,
          known as "nibbles".  See set print nibbles.

     '-memory-tag-violations [on|off]'
          Set printing of additional information about memory tag
          violations.  See set print memory-tag-violations.

     '-null-stop [on|off]'
          Set printing of char arrays to stop at first null char.
          Related setting: set print null-stop.

     '-object [on|off]'
          Set printing C++ virtual function tables.  Related setting:
          set print object.

     '-pretty [on|off]'
          Set pretty formatting of structures.  Related setting:
          set print pretty.

     '-raw-values [on|off]'
          Set whether to print values in raw form, bypassing any
          pretty-printers for that value.  Related setting: set print raw-values.

     '-repeats NUMBER-OF-REPEATS|unlimited'
          Set threshold for repeated print elements.  'unlimited' causes
          all elements to be individually printed.  Related setting:
          set print repeats.

     '-static-members [on|off]'
          Set printing C++ static members.  Related setting: set print static-members.

     '-symbol [on|off]'
          Set printing of symbol names when printing pointers.  Related
          setting: set print symbol.

     '-union [on|off]'
          Set printing of unions interior to structures.  Related
          setting: set print union.

     '-vtbl [on|off]'
          Set printing of C++ virtual function tables.  Related setting:
          set print vtbl.

     Because the 'print' command accepts arbitrary expressions which may
     look like options (including abbreviations), if you specify any
     command option, then you must use a double dash ('--') to mark the
     end of option processing.

     For example, this prints the value of the '-p' expression:

          (gdb) print -p

     While this repeats the last value in the value history (see below)
     with the '-pretty' option in effect:

          (gdb) print -p --

     Here is an example including both on option and an expression:

          (gdb) print -pretty -- *myptr
          $1 = {
            next = 0x0,
            flags = {
              sweet = 1,
              sour = 1
            },
            meat = 0x54 "Pork"
          }

'print [OPTIONS]'
'print [OPTIONS] /F'
     If you omit EXPR, GDB displays the last value again (from the
     "value history"; see Value History).  This allows
     you to conveniently inspect the same value in an alternative
     format.

   If the architecture supports memory tagging, the 'print' command will
display pointer/memory tag mismatches if what is being printed is a
pointer or reference type.  See Memory Tagging.

   A more low-level way of examining data is with the 'x' command.  It
examines data in memory at a specified address and prints it in a
specified format.  See Examining Memory.

   If you are interested in information about types, or about how the
fields of a struct or a class are declared, use the 'ptype EXPR' command
rather than 'print'.  See Examining the Symbol Table.

   Another way of examining values of expressions and type information
is through the Python extension command 'explore' (available only if the
GDB build is configured with '--with-python').  It offers an interactive
way to start at the highest level (or, the most abstract level) of the
data type of an expression (or, the data type itself) and explore all
the way down to leaf scalar values/fields embedded in the higher level
data types.

'explore ARG'
     ARG is either an expression (in the source language), or a type
     visible in the current context of the program being debugged.

   The working of the 'explore' command can be illustrated with an
example.  If a data type 'struct ComplexStruct' is defined in your C
program as

     struct SimpleStruct
     {
       int i;
       double d;
     };

     struct ComplexStruct
     {
       struct SimpleStruct *ss_p;
       int arr[10];
     };

followed by variable declarations as

     struct SimpleStruct ss = { 10, 1.11 };
     struct ComplexStruct cs = { &ss, { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 } };

then, the value of the variable 'cs' can be explored using the 'explore'
command as follows.

     (gdb) explore cs
     The value of `cs' is a struct/class of type `struct ComplexStruct' with
     the following fields:

       ss_p = <Enter 0 to explore this field of type `struct SimpleStruct *'>
        arr = <Enter 1 to explore this field of type `int [10]'>

     Enter the field number of choice:

Since the fields of 'cs' are not scalar values, you are being prompted
to chose the field you want to explore.  Let's say you choose the field
'ss_p' by entering '0'.  Then, since this field is a pointer, you will
be asked if it is pointing to a single value.  From the declaration of
'cs' above, it is indeed pointing to a single value, hence you enter
'y'.  If you enter 'n', then you will be asked if it were pointing to an
array of values, in which case this field will be explored as if it were
an array.

     `cs.ss_p' is a pointer to a value of type `struct SimpleStruct'
     Continue exploring it as a pointer to a single value [y/n]: y
     The value of `*(cs.ss_p)' is a struct/class of type `struct
     SimpleStruct' with the following fields:

       i = 10 .. (Value of type `int')
       d = 1.1100000000000001 .. (Value of type `double')

     Press enter to return to parent value:

If the field 'arr' of 'cs' was chosen for exploration by entering '1'
earlier, then since it is as array, you will be prompted to enter the
index of the element in the array that you want to explore.

     `cs.arr' is an array of `int'.
     Enter the index of the element you want to explore in `cs.arr': 5

     `(cs.arr)[5]' is a scalar value of type `int'.

     (cs.arr)[5] = 4

     Press enter to return to parent value:

   In general, at any stage of exploration, you can go deeper towards
the leaf values by responding to the prompts appropriately, or hit the
return key to return to the enclosing data structure (the higher level
data structure).

   Similar to exploring values, you can use the 'explore' command to
explore types.  Instead of specifying a value (which is typically a
variable name or an expression valid in the current context of the
program being debugged), you specify a type name.  If you consider the
same example as above, your can explore the type 'struct ComplexStruct'
by passing the argument 'struct ComplexStruct' to the 'explore' command.

     (gdb) explore struct ComplexStruct

By responding to the prompts appropriately in the subsequent interactive
session, you can explore the type 'struct ComplexStruct' in a manner
similar to how the value 'cs' was explored in the above example.

   The 'explore' command also has two sub-commands, 'explore value' and
'explore type'.  The former sub-command is a way to explicitly specify
that value exploration of the argument is being invoked, while the
latter is a way to explicitly specify that type exploration of the
argument is being invoked.

'explore value EXPR'
     This sub-command of 'explore' explores the value of the expression
     EXPR (if EXPR is an expression valid in the current context of the
     program being debugged).  The behavior of this command is identical
     to that of the behavior of the 'explore' command being passed the
     argument EXPR.

'explore type ARG'
     This sub-command of 'explore' explores the type of ARG (if ARG is a
     type visible in the current context of program being debugged), or
     the type of the value/expression ARG (if ARG is an expression valid
     in the current context of the program being debugged).  If ARG is a
     type, then the behavior of this command is identical to that of the
     'explore' command being passed the argument ARG.  If ARG is an
     expression, then the behavior of this command will be identical to
     that of the 'explore' command being passed the type of ARG as the
     argument.

10.1 Expressions
================

'print' and many other GDB commands accept an expression and compute its
value.  Any kind of constant, variable or operator defined by the
programming language you are using is valid in an expression in GDB.
This includes conditional expressions, function calls, casts, and string
constants.  It also includes preprocessor macros, if you compiled your
program to include this information; see Compilation.

   GDB supports array constants in expressions input by the user.  The
syntax is {ELEMENT, ELEMENT...}.  For example, you can use the command
'print {1, 2, 3}' to create an array of three integers.  If you pass an
array to a function or assign it to a program variable, GDB copies the
array to memory that is 'malloc'ed in the target program.

   Because C is so widespread, most of the expressions shown in examples
in this manual are in C. See Using GDB with Different Languages,
for information on how to use expressions in other languages.

   In this section, we discuss operators that you can use in GDB
expressions regardless of your programming language.

   Casts are supported in all languages, not just in C, because it is so
useful to cast a number into a pointer in order to examine a structure
at that address in memory.

   GDB supports these operators, in addition to those common to
programming languages:

'@'
     '@' is a binary operator for treating parts of memory as arrays.
     See Artificial Arrays, for more information.

'::'
     '::' allows you to specify a variable in terms of the file or
     function where it is defined.  See Program Variables.

'{TYPE} ADDR'
     Refers to an object of type TYPE stored at address ADDR in memory.
     The address ADDR may be any expression whose value is an integer or
     pointer (but parentheses are required around binary operators, just
     as in a cast).  This construct is allowed regardless of what kind
     of data is normally supposed to reside at ADDR.

10.2 Ambiguous Expressions
==========================

Expressions can sometimes contain some ambiguous elements.  For
instance, some programming languages (notably Ada, C++ and Objective-C)
permit a single function name to be defined several times, for
application in different contexts.  This is called "overloading".
Another example involving Ada is generics.  A "generic package" is
similar to C++ templates and is typically instantiated several times,
resulting in the same function name being defined in different contexts.

   In some cases and depending on the language, it is possible to adjust
the expression to remove the ambiguity.  For instance in C++, you can
specify the signature of the function you want to break on, as in 'break
FUNCTION(TYPES)'.  In Ada, using the fully qualified name of your
function often makes the expression unambiguous as well.

   When an ambiguity that needs to be resolved is detected, the debugger
has the capability to display a menu of numbered choices for each
possibility, and then waits for the selection with the prompt '>'.  The
first option is always '[0] cancel', and typing '0 <RET>' aborts the
current command.  If the command in which the expression was used allows
more than one choice to be selected, the next option in the menu is '[1]
all', and typing '1 <RET>' selects all possible choices.

   For example, the following session excerpt shows an attempt to set a
breakpoint at the overloaded symbol 'String::after'.  We choose three
particular definitions of that function name:

     (gdb) b String::after
     [0] cancel
     [1] all
     [2] file:String.cc; line number:867
     [3] file:String.cc; line number:860
     [4] file:String.cc; line number:875
     [5] file:String.cc; line number:853
     [6] file:String.cc; line number:846
     [7] file:String.cc; line number:735
     > 2 4 6
     Breakpoint 1 at 0xb26c: file String.cc, line 867.
     Breakpoint 2 at 0xb344: file String.cc, line 875.
     Breakpoint 3 at 0xafcc: file String.cc, line 846.
     Multiple breakpoints were set.
     Use the "delete" command to delete unwanted
      breakpoints.
     (gdb)

'set multiple-symbols MODE'

     This option allows you to adjust the debugger behavior when an
     expression is ambiguous.

     By default, MODE is set to 'all'.  If the command with which the
     expression is used allows more than one choice, then GDB
     automatically selects all possible choices.  For instance,
     inserting a breakpoint on a function using an ambiguous name
     results in a breakpoint inserted on each possible match.  However,
     if a unique choice must be made, then GDB uses the menu to help you
     disambiguate the expression.  For instance, printing the address of
     an overloaded function will result in the use of the menu.

     When MODE is set to 'ask', the debugger always uses the menu when
     an ambiguity is detected.

     Finally, when MODE is set to 'cancel', the debugger reports an
     error due to the ambiguity and the command is aborted.

'show multiple-symbols'
     Show the current value of the 'multiple-symbols' setting.

10.3 Program Variables
======================

The most common kind of expression to use is the name of a variable in
your program.

   Variables in expressions are understood in the selected stack frame
(see Selecting a Frame); they must be either:

   * global (or file-static)

or

   * visible according to the scope rules of the programming language
     from the point of execution in that frame

This means that in the function

     foo (a)
          int a;
     {
       bar (a);
       {
         int b = test ();
         bar (b);
       }
     }

you can examine and use the variable 'a' whenever your program is
executing within the function 'foo', but you can only use or examine the
variable 'b' while your program is executing inside the block where 'b'
is declared.

   There is an exception: you can refer to a variable or function whose
scope is a single source file even if the current execution point is not
in this file.  But it is possible to have more than one such variable or
function with the same name (in different source files).  If that
happens, referring to that name has unpredictable effects.  If you wish,
you can specify a static variable in a particular function or file by
using the colon-colon ('::') notation:

     FILE::VARIABLE
     FUNCTION::VARIABLE

Here FILE or FUNCTION is the name of the context for the static
VARIABLE.  In the case of file names, you can use quotes to make sure
GDB parses the file name as a single word--for example, to print a
global value of 'x' defined in 'f2.c':

     (gdb) p 'f2.c'::x

   The '::' notation is normally used for referring to static variables,
since you typically disambiguate uses of local variables in functions by
selecting the appropriate frame and using the simple name of the
variable.  However, you may also use this notation to refer to local
variables in frames enclosing the selected frame:

     void
     foo (int a)
     {
       if (a < 10)
         bar (a);
       else
         process (a);    /* Stop here */
     }

     int
     bar (int a)
     {
       foo (a + 5);
     }

For example, if there is a breakpoint at the commented line, here is
what you might see when the program stops after executing the call
'bar(0)':

     (gdb) p a
     $1 = 10
     (gdb) p bar::a
     $2 = 5
     (gdb) up 2
     #2  0x080483d0 in foo (a=5) at foobar.c:12
     (gdb) p a
     $3 = 5
     (gdb) p bar::a
     $4 = 0

   These uses of '::' are very rarely in conflict with the very similar
use of the same notation in C++.  When they are in conflict, the C++
meaning takes precedence; however, this can be overridden by quoting the
file or function name with single quotes.

   For example, suppose the program is stopped in a method of a class
that has a field named 'includefile', and there is also an include file
named 'includefile' that defines a variable, 'some_global'.

     (gdb) p includefile
     $1 = 23
     (gdb) p includefile::some_global
     A syntax error in expression, near `'.
     (gdb) p 'includefile'::some_global
     $2 = 27

     _Warning:_ Occasionally, a local variable may appear to have the
     wrong value at certain points in a function--just after entry to a
     new scope, and just before exit.
   You may see this problem when you are stepping by machine
instructions.  This is because, on most machines, it takes more than one
instruction to set up a stack frame (including local variable
definitions); if you are stepping by machine instructions, variables may
appear to have the wrong values until the stack frame is completely
built.  On exit, it usually also takes more than one machine instruction
to destroy a stack frame; after you begin stepping through that group of
instructions, local variable definitions may be gone.

   This may also happen when the compiler does significant
optimizations.  To be sure of always seeing accurate values, turn off
all optimization when compiling.

   Another possible effect of compiler optimizations is to optimize
unused variables out of existence, or assign variables to registers (as
opposed to memory addresses).  Depending on the support for such cases
offered by the debug info format used by the compiler, GDB might not be
able to display values for such local variables.  If that happens, GDB
will print a message like this:

     No symbol "foo" in current context.

   To solve such problems, either recompile without optimizations, or
use a different debug info format, if the compiler supports several such
formats.  See Compilation, for more information on choosing compiler
options.  See C and C++, for more information about debug info
formats that are best suited to C++ programs.

   If you ask to print an object whose contents are unknown to GDB,
e.g., because its data type is not completely specified by the debug
information, GDB will say '<incomplete type>'.  See incomplete type,
for more about this.

   If you try to examine or use the value of a (global) variable for
which GDB has no type information, e.g., because the program includes no
debug information, GDB displays an error message.  See unknown type,
for more about unknown types.  If you cast the variable to its
declared type, GDB gets the variable's value using the cast-to type as
the variable's type.  For example, in a C program:

       (gdb) p var
       'var' has unknown type; cast it to its declared type
       (gdb) p (float) var
       $1 = 3.14

   If you append '@entry' string to a function parameter name you get
its value at the time the function got called.  If the value is not
available an error message is printed.  Entry values are available only
with some compilers.  Entry values are normally also printed at the
function parameter list according to set print entry-values.

     Breakpoint 1, d (i=30) at gdb.base/entry-value.c:29
     29	  i++;
     (gdb) next
     30	  e (i);
     (gdb) print i
     $1 = 31
     (gdb) print i@entry
     $2 = 30

   Strings are identified as arrays of 'char' values without specified
signedness.  Arrays of either 'signed char' or 'unsigned char' get
printed as arrays of 1 byte sized integers.  '-fsigned-char' or
'-funsigned-char' GCC options have no effect as GDB defines literal
string type '"char"' as 'char' without a sign.  For program code

     char var0[] = "A";
     signed char var1[] = "A";

   You get during debugging
     (gdb) print var0
     $1 = "A"
     (gdb) print var1
     $2 = {65 'A', 0 '\0'}

10.4 Artificial Arrays
======================

It is often useful to print out several successive objects of the same
type in memory; a section of an array, or an array of dynamically
determined size for which only a pointer exists in the program.

   You can do this by referring to a contiguous span of memory as an
"artificial array", using the binary operator '@'.  The left operand of
'@' should be the first element of the desired array and be an
individual object.  The right operand should be the desired length of
the array.  The result is an array value whose elements are all of the
type of the left argument.  The first element is actually the left
argument; the second element comes from bytes of memory immediately
following those that hold the first element, and so on.  Here is an
example.  If a program says

     int *array = (int *) malloc (len * sizeof (int));

you can print the contents of 'array' with

     p *array@len

   The left operand of '@' must reside in memory.  Array values made
with '@' in this way behave just like other arrays in terms of
subscripting, and are coerced to pointers when used in expressions.
Artificial arrays most often appear in expressions via the value history
(see Value History), after printing one out.

   Another way to create an artificial array is to use a cast.  This
re-interprets a value as if it were an array.  The value need not be in
memory:
     (gdb) p/x (short[2])0x12345678
     $1 = {0x1234, 0x5678}

   As a convenience, if you leave the array length out (as in
'(TYPE[])VALUE') GDB calculates the size to fill the value (as
'sizeof(VALUE)/sizeof(TYPE)':
     (gdb) p/x (short[])0x12345678
     $2 = {0x1234, 0x5678}

   Sometimes the artificial array mechanism is not quite enough; in
moderately complex data structures, the elements of interest may not
actually be adjacent--for example, if you are interested in the values
of pointers in an array.  One useful work-around in this situation is to
use a convenience variable (see Convenience Variables)
as a counter in an expression that prints the first interesting
value, and then repeat that expression via <RET>.  For instance, suppose
you have an array 'dtab' of pointers to structures, and you are
interested in the values of a field 'fv' in each structure.  Here is an
example of what you might type:

     set $i = 0
     p dtab[$i++]->fv
     <RET>
     <RET>
     ...

10.5 Output Formats
===================

By default, GDB prints a value according to its data type.  Sometimes
this is not what you want.  For example, you might want to print a
number in hex, or a pointer in decimal.  Or you might want to view data
in memory at a certain address as a character string or as an
instruction.  To do these things, specify an "output format" when you
print a value.

   The simplest use of output formats is to say how to print a value
already computed.  This is done by starting the arguments of the 'print'
command with a slash and a format letter.  The format letters supported
are:

'x'
     Print the binary representation of the value in hexadecimal.

'd'
     Print the binary representation of the value in decimal.

'u'
     Print the binary representation of the value as an decimal, as if
     it were unsigned.

'o'
     Print the binary representation of the value in octal.

't'
     Print the binary representation of the value in binary.  The letter
     't' stands for "two".  (1)

'a'
     Print as an address, both absolute in hexadecimal and as an offset
     from the nearest preceding symbol.  You can use this format used to
     discover where (in what function) an unknown address is located:

          (gdb) p/a 0x54320
          $3 = 0x54320 <_initialize_vx+396>

     The command 'info symbol 0x54320' yields similar results.  See
     info symbol.

'c'
     Cast the value to an integer (unlike other formats, this does not
     just reinterpret the underlying bits) and print it as a character
     constant.  This prints both the numerical value and its character
     representation.  The character representation is replaced with the
     octal escape '\nnn' for characters outside the 7-bit ASCII range.

     Without this format, GDB displays 'char', 'unsigned char', and
     'signed char' data as character constants.  Single-byte members of
     vectors are displayed as integer data.

'f'
     Regard the bits of the value as a floating point number and print
     using typical floating point syntax.

's'
     Regard as a string, if possible.  With this format, pointers to
     single-byte data are displayed as null-terminated strings and
     arrays of single-byte data are displayed as fixed-length strings.
     Other values are displayed in their natural types.

     Without this format, GDB displays pointers to and arrays of 'char',
     'unsigned char', and 'signed char' as strings.  Single-byte members
     of a vector are displayed as an integer array.

'z'
     Like 'x' formatting, the value is treated as an integer and printed
     as hexadecimal, but leading zeros are printed to pad the value to
     the size of the integer type.

'r'
     Print using the 'raw' formatting.  By default, GDB will use a
     Python-based pretty-printer, if one is available (see Pretty Printing).
     This typically results in a higher-level display of
     the value's contents.  The 'r' format bypasses any Python
     pretty-printer which might exist.

   For example, to print the program counter in hex (see Registers),
type

     p/x $pc

Note that no space is required before the slash; this is because command
names in GDB cannot contain a slash.

   To reprint the last value in the value history with a different
format, you can use the 'print' command with just a format and no
expression.  For example, 'p/x' reprints the last value in hex.

   ---------- Footnotes ----------

   (1) 'b' cannot be used because these format letters are also used
with the 'x' command, where 'b' stands for "byte"; see Examining Memory.

10.6 Examining Memory
=====================

You can use the command 'x' (for "examine") to examine memory in any of
several formats, independently of your program's data types.

'x/NFU ADDR'
'x ADDR'
'x'
     Use the 'x' command to examine memory.

   N, F, and U are all optional parameters that specify how much memory
to display and how to format it; ADDR is an expression giving the
address where you want to start displaying memory.  If you use defaults
for NFU, you need not type the slash '/'.  Several commands set
convenient defaults for ADDR.

N, the repeat count
     The repeat count is a decimal integer; the default is 1.  It
     specifies how much memory (counting by units U) to display.  If a
     negative number is specified, memory is examined backward from
     ADDR.

F, the display format
     The display format is one of the formats used by 'print' ('x', 'd',
     'u', 'o', 't', 'a', 'c', 'f', 's'), 'i' (for machine instructions)
     and 'm' (for displaying memory tags).  The default is 'x'
     (hexadecimal) initially.  The default changes each time you use
     either 'x' or 'print'.

U, the unit size
     The unit size is any of

     'b'
          Bytes.
     'h'
          Halfwords (two bytes).
     'w'
          Words (four bytes).  This is the initial default.
     'g'
          Giant words (eight bytes).

     Each time you specify a unit size with 'x', that size becomes the
     default unit the next time you use 'x'.  For the 'i' format, the
     unit size is ignored and is normally not written.  For the 's'
     format, the unit size defaults to 'b', unless it is explicitly
     given.  Use 'x /hs' to display 16-bit char strings and 'x /ws' to
     display 32-bit strings.  The next use of 'x /s' will again display
     8-bit strings.  Note that the results depend on the programming
     language of the current compilation unit.  If the language is C,
     the 's' modifier will use the UTF-16 encoding while 'w' will use
     UTF-32.  The encoding is set by the programming language and cannot
     be altered.

ADDR, starting display address
     ADDR is the address where you want GDB to begin displaying memory.
     The expression need not have a pointer value (though it may); it is
     always interpreted as an integer address of a byte of memory.
     See Expressions, for more information on
     expressions.  The default for ADDR is usually just after the last
     address examined--but several other commands also set the default
     address: 'info breakpoints' (to the address of the last breakpoint
     listed), 'info line' (to the starting address of a line), and
     'print' (if you use it to display a value from memory).

   For example, 'x/3uh 0x54320' is a request to display three halfwords
('h') of memory, formatted as unsigned decimal integers ('u'), starting
at address '0x54320'.  'x/4xw $sp' prints the four words ('w') of memory
above the stack pointer (here, '$sp'; see Registers) in
hexadecimal ('x').

   You can also specify a negative repeat count to examine memory
backward from the given address.  For example, 'x/-3uh 0x54320' prints
three halfwords ('h') at '0x5431a', '0x5431c', and '0x5431e'.

   Since the letters indicating unit sizes are all distinct from the
letters specifying output formats, you do not have to remember whether
unit size or format comes first; either order works.  The output
specifications '4xw' and '4wx' mean exactly the same thing.  (However,
the count N must come first; 'wx4' does not work.)

   Even though the unit size U is ignored for the formats 's' and 'i',
you might still want to use a count N; for example, '3i' specifies that
you want to see three machine instructions, including any operands.  For
convenience, especially when used with the 'display' command, the 'i'
format also prints branch delay slot instructions, if any, beyond the
count specified, which immediately follow the last instruction that is
within the count.  The command 'disassemble' gives an alternative way of
inspecting machine instructions; see Source and Machine Code.

   If a negative repeat count is specified for the formats 's' or 'i',
the command displays null-terminated strings or instructions before the
given address as many as the absolute value of the given number.  For
the 'i' format, we use line number information in the debug info to
accurately locate instruction boundaries while disassembling backward.
If line info is not available, the command stops examining memory with
an error message.

   All the defaults for the arguments to 'x' are designed to make it
easy to continue scanning memory with minimal specifications each time
you use 'x'.  For example, after you have inspected three machine
instructions with 'x/3i ADDR', you can inspect the next seven with just
'x/7'.  If you use <RET> to repeat the 'x' command, the repeat count N
is used again; the other arguments default as for successive uses of
'x'.

   When examining machine instructions, the instruction at current
program counter is shown with a '=>' marker.  For example:

     (gdb) x/5i $pc-6
        0x804837f <main+11>: mov    %esp,%ebp
        0x8048381 <main+13>: push   %ecx
        0x8048382 <main+14>: sub    $0x4,%esp
     => 0x8048385 <main+17>: movl   $0x8048460,(%esp)
        0x804838c <main+24>: call   0x80482d4 <puts@plt>

   If the architecture supports memory tagging, the tags can be
displayed by using 'm'.  See Memory Tagging.

   The information will be displayed once per granule size (the amount
of bytes a particular memory tag covers).  For example, AArch64 has a
granule size of 16 bytes, so it will display a tag every 16 bytes.

   Due to the way GDB prints information with the 'x' command (not
aligned to a particular boundary), the tag information will refer to the
initial address displayed on a particular line.  If a memory tag
boundary is crossed in the middle of a line displayed by the 'x'
command, it will be displayed on the next line.

   The 'm' format doesn't affect any other specified formats that were
passed to the 'x' command.

   The addresses and contents printed by the 'x' command are not saved
in the value history because there is often too much of them and they
would get in the way.  Instead, GDB makes these values available for
subsequent use in expressions as values of the convenience variables
'$_' and '$__'.  After an 'x' command, the last address examined is
available for use in expressions in the convenience variable '$_'.  The
contents of that address, as examined, are available in the convenience
variable '$__'.

   If the 'x' command has a repeat count, the address and contents saved
are from the last memory unit printed; this is not the same as the last
address printed if several units were printed on the last line of
output.

   Most targets have an addressable memory unit size of 8 bits.  This
means that to each memory address are associated 8 bits of data.  Some
targets, however, have other addressable memory unit sizes.  Within GDB
and this document, the term "addressable memory unit" (or "memory unit"
for short) is used when explicitly referring to a chunk of data of that
size.  The word "byte" is used to refer to a chunk of data of 8 bits,
regardless of the addressable memory unit size of the target.  For most
systems, addressable memory unit is a synonym of byte.

   When you are debugging a program running on a remote target machine
(see Remote Debugging), you may wish to verify the program's image
in the remote machine's memory against the executable file you
downloaded to the target.  Or, on any target, you may want to check
whether the program has corrupted its own read-only sections.  The
'compare-sections' command is provided for such situations.

'compare-sections [SECTION-NAME|-r]'
     Compare the data of a loadable section SECTION-NAME in the
     executable file of the program being debugged with the same section
     in the target machine's memory, and report any mismatches.  With no
     arguments, compares all loadable sections.  With an argument of
     '-r', compares all loadable read-only sections.

     Note: for remote targets, this command can be accelerated if the
     target supports computing the CRC checksum of a block of memory
     (see qCRC packet).

10.7 Memory Tagging
===================

Memory tagging is a memory protection technology that uses a pair of
tags to validate memory accesses through pointers.  The tags are integer
values usually comprised of a few bits, depending on the architecture.

   There are two types of tags that are used in this setup: logical and
allocation.  A logical tag is stored in the pointers themselves, usually
at the higher bits of the pointers.  An allocation tag is the tag
associated with particular ranges of memory in the physical address
space, against which the logical tags from pointers are compared.

   The pointer tag (logical tag) must match the memory tag (allocation
tag) for the memory access to be valid.  If the logical tag does not
match the allocation tag, that will raise a memory violation.

   Allocation tags cover multiple contiguous bytes of physical memory.
This range of bytes is called a memory tag granule and is
architecture-specific.  For example, AArch64 has a tag granule of 16
bytes, meaning each allocation tag spans 16 bytes of memory.

   If the underlying architecture supports memory tagging, like AArch64
MTE or SPARC ADI do, GDB can make use of it to validate pointers against
memory allocation tags.

   The 'print' (see Data) and 'x' (see Memory) commands will
display tag information when appropriate, and a command prefix of
'memory-tag' gives access to the various memory tagging commands.

   The 'memory-tag' commands are the following:

'memory-tag print-logical-tag POINTER_EXPRESSION'
     Print the logical tag stored in POINTER_EXPRESSION.
'memory-tag with-logical-tag POINTER_EXPRESSION TAG_BYTES'
     Print the pointer given by POINTER_EXPRESSION, augmented with a
     logical tag of TAG_BYTES.
'memory-tag print-allocation-tag ADDRESS_EXPRESSION'
     Print the allocation tag associated with the memory address given
     by ADDRESS_EXPRESSION.
'memory-tag setatag STARTING_ADDRESS LENGTH TAG_BYTES'
     Set the allocation tag(s) for memory range [STARTING_ADDRESS,
     STARTING_ADDRESS + LENGTH) to TAG_BYTES.
'memory-tag check POINTER_EXPRESSION'
     Check if the logical tag in the pointer given by POINTER_EXPRESSION
     matches the allocation tag for the memory referenced by the
     pointer.

     This essentially emulates the hardware validation that is done when
     tagged memory is accessed through a pointer, but does not cause a
     memory fault as it would during hardware validation.

     It can be used to inspect potential memory tagging violations in
     the running process, before any faults get triggered.

10.8 Automatic Display
======================

If you find that you want to print the value of an expression frequently
(to see how it changes), you might want to add it to the "automatic
display list" so that GDB prints its value each time your program stops.
Each expression added to the list is given a number to identify it; to
remove an expression from the list, you specify that number.  The
automatic display looks like this:

     2: foo = 38
     3: bar[5] = (struct hack *) 0x3804

This display shows item numbers, expressions and their current values.
As with displays you request manually using 'x' or 'print', you can
specify the output format you prefer; in fact, 'display' decides whether
to use 'print' or 'x' depending your format specification--it uses 'x'
if you specify either the 'i' or 's' format, or a unit size; otherwise
it uses 'print'.

'display EXPR'
     Add the expression EXPR to the list of expressions to display each
     time your program stops.  See Expressions.

     'display' does not repeat if you press <RET> again after using it.

'display/FMT EXPR'
     For FMT specifying only a display format and not a size or count,
     add the expression EXPR to the auto-display list but arrange to
     display it each time in the specified format FMT.  See Output Formats.

'display/FMT ADDR'
     For FMT 'i' or 's', or including a unit-size or a number of units,
     add the expression ADDR as a memory address to be examined each
     time your program stops.  Examining means in effect doing 'x/FMT
     ADDR'.  See Examining Memory.

   For example, 'display/i $pc' can be helpful, to see the machine
instruction about to be executed each time execution stops ('$pc' is a
common name for the program counter; see Registers).

'undisplay DNUMS...'
'delete display DNUMS...'
     Remove items from the list of expressions to display.  Specify the
     numbers of the displays that you want affected with the command
     argument DNUMS.  It can be a single display number, one of the
     numbers shown in the first field of the 'info display' display; or
     it could be a range of display numbers, as in '2-4'.

     'undisplay' does not repeat if you press <RET> after using it.
     (Otherwise you would just get the error 'No display number ...'.)

'disable display DNUMS...'
     Disable the display of item numbers DNUMS.  A disabled display item
     is not printed automatically, but is not forgotten.  It may be
     enabled again later.  Specify the numbers of the displays that you
     want affected with the command argument DNUMS.  It can be a single
     display number, one of the numbers shown in the first field of the
     'info display' display; or it could be a range of display numbers,
     as in '2-4'.

'enable display DNUMS...'
     Enable display of item numbers DNUMS.  It becomes effective once
     again in auto display of its expression, until you specify
     otherwise.  Specify the numbers of the displays that you want
     affected with the command argument DNUMS.  It can be a single
     display number, one of the numbers shown in the first field of the
     'info display' display; or it could be a range of display numbers,
     as in '2-4'.

'display'
     Display the current values of the expressions on the list, just as
     is done when your program stops.

'info display'
     Print the list of expressions previously set up to display
     automatically, each one with its item number, but without showing
     the values.  This includes disabled expressions, which are marked
     as such.  It also includes expressions which would not be displayed
     right now because they refer to automatic variables not currently
     available.

   If a display expression refers to local variables, then it does not
make sense outside the lexical context for which it was set up.  Such an
expression is disabled when execution enters a context where one of its
variables is not defined.  For example, if you give the command 'display
last_char' while inside a function with an argument 'last_char', GDB
displays this argument while your program continues to stop inside that
function.  When it stops elsewhere--where there is no variable
'last_char'--the display is disabled automatically.  The next time your
program stops where 'last_char' is meaningful, you can enable the
display expression once again.

10.9 Print Settings
===================

GDB provides the following ways to control how arrays, structures, and
symbols are printed.

These settings are useful for debugging programs in any language:

'set print address'
'set print address on'
     GDB prints memory addresses showing the location of stack traces,
     structure values, pointer values, breakpoints, and so forth, even
     when it also displays the contents of those addresses.  The default
     is 'on'.  For example, this is what a stack frame display looks
     like with 'set print address on':

          (gdb) f
          #0  set_quotes (lq=0x34c78 "<<", rq=0x34c88 ">>")
              at input.c:530
          530         if (lquote != def_lquote)

'set print address off'
     Do not print addresses when displaying their contents.  For
     example, this is the same stack frame displayed with 'set print
     address off':

          (gdb) set print addr off
          (gdb) f
          #0  set_quotes (lq="<<", rq=">>") at input.c:530
          530         if (lquote != def_lquote)

     You can use 'set print address off' to eliminate all machine
     dependent displays from the GDB interface.  For example, with
     'print address off', you should get the same text for backtraces on
     all machines--whether or not they involve pointer arguments.

'show print address'
     Show whether or not addresses are to be printed.

   When GDB prints a symbolic address, it normally prints the closest
earlier symbol plus an offset.  If that symbol does not uniquely
identify the address (for example, it is a name whose scope is a single
source file), you may need to clarify.  One way to do this is with 'info
line', for example 'info line *0x4537'.  Alternately, you can set GDB to
print the source file and line number when it prints a symbolic address:

'set print symbol-filename on'
     Tell GDB to print the source file name and line number of a symbol
     in the symbolic form of an address.

'set print symbol-filename off'
     Do not print source file name and line number of a symbol.  This is
     the default.

'show print symbol-filename'
     Show whether or not GDB will print the source file name and line
     number of a symbol in the symbolic form of an address.

   Another situation where it is helpful to show symbol filenames and
line numbers is when disassembling code; GDB shows you the line number
and source file that corresponds to each instruction.

   Also, you may wish to see the symbolic form only if the address being
printed is reasonably close to the closest earlier symbol:

'set print max-symbolic-offset MAX-OFFSET'
'set print max-symbolic-offset unlimited'
     Tell GDB to only display the symbolic form of an address if the
     offset between the closest earlier symbol and the address is less
     than MAX-OFFSET.  The default is 'unlimited', which tells GDB to
     always print the symbolic form of an address if any symbol precedes
     it.  Zero is equivalent to 'unlimited'.

'show print max-symbolic-offset'
     Ask how large the maximum offset is that GDB prints in a symbolic
     address.

   If you have a pointer and you are not sure where it points, try 'set
print symbol-filename on'.  Then you can determine the name and source
file location of the variable where it points, using 'p/a POINTER'.
This interprets the address in symbolic form.  For example, here GDB
shows that a variable 'ptt' points at another variable 't', defined in
'hi2.c':

     (gdb) set print symbol-filename on
     (gdb) p/a ptt
     $4 = 0xe008 <t in hi2.c>

     _Warning:_ For pointers that point to a local variable, 'p/a' does
     not show the symbol name and filename of the referent, even with
     the appropriate 'set print' options turned on.

   You can also enable '/a'-like formatting all the time using 'set
print symbol on':

'set print symbol on'
     Tell GDB to print the symbol corresponding to an address, if one
     exists.

'set print symbol off'
     Tell GDB not to print the symbol corresponding to an address.  In
     this mode, GDB will still print the symbol corresponding to
     pointers to functions.  This is the default.

'show print symbol'
     Show whether GDB will display the symbol corresponding to an
     address.

   Other settings control how different kinds of objects are printed:

'set print array'
'set print array on'
     Pretty print arrays.  This format is more convenient to read, but
     uses more space.  The default is off.

'set print array off'
     Return to compressed format for arrays.

'show print array'
     Show whether compressed or pretty format is selected for displaying
     arrays.

'set print array-indexes'
'set print array-indexes on'
     Print the index of each element when displaying arrays.  May be
     more convenient to locate a given element in the array or quickly
     find the index of a given element in that printed array.  The
     default is off.

'set print array-indexes off'
     Stop printing element indexes when displaying arrays.

'show print array-indexes'
     Show whether the index of each element is printed when displaying
     arrays.

'set print nibbles'
'set print nibbles on'
     Print binary values in groups of four bits, known as "nibbles",
     when using the print command of GDB with the option '/t'.  For
     example, this is what it looks like with 'set print nibbles on':

          (gdb) print val_flags
          $1 = 1230
          (gdb) print/t val_flags
          $2 = 0100 1100 1110

'set print nibbles off'
     Don't printing binary values in groups.  This is the default.

'show print nibbles'
     Show whether to print binary values in groups of four bits.

'set print characters NUMBER-OF-CHARACTERS'
'set print characters elements'
'set print characters unlimited'
     Set a limit on how many characters of a string GDB will print.  If
     GDB is printing a large string, it stops printing after it has
     printed the number of characters set by the 'set print characters'
     command.  This equally applies to multi-byte and wide character
     strings, that is for strings whose character type is 'wchar_t',
     'char16_t', or 'char32_t' it is the number of actual characters
     rather than underlying bytes the encoding uses that this setting
     controls.  Setting NUMBER-OF-CHARACTERS to 'elements' means that
     the limit on the number of characters to print follows one for
     array elements; see set print elements.  Setting
     NUMBER-OF-CHARACTERS to 'unlimited' means that the number of
     characters to print is unlimited.  When GDB starts, this limit is
     set to 'elements'.

'show print characters'
     Display the number of characters of a large string that GDB will
     print.

'set print elements NUMBER-OF-ELEMENTS'
'set print elements unlimited'
     Set a limit on how many elements of an array GDB will print.  If
     GDB is printing a large array, it stops printing after it has
     printed the number of elements set by the 'set print elements'
     command.  By default this limit also applies to the display of
     strings; see set print characters.  When GDB starts, this
     limit is set to 200.  Setting NUMBER-OF-ELEMENTS to 'unlimited' or
     zero means that the number of elements to print is unlimited.

     When printing very large arrays, whose size is greater than
     'max-value-size' (see max-value-size), if
     the 'print elements' is set such that the size of the elements
     being printed is less than or equal to 'max-value-size', then GDB
     will print the array (up to the 'print elements' limit), and only
     'max-value-size' worth of data will be added into the value history
     (see Value History).

'show print elements'
     Display the number of elements of a large array that GDB will
     print.

'set print frame-arguments VALUE'
     This command allows to control how the values of arguments are
     printed when the debugger prints a frame (see Frames).  The
     possible values are:

     'all'
          The values of all arguments are printed.

     'scalars'
          Print the value of an argument only if it is a scalar.  The
          value of more complex arguments such as arrays, structures,
          unions, etc, is replaced by '...'.  This is the default.  Here
          is an example where only scalar arguments are shown:

               #1  0x08048361 in call_me (i=3, s=..., ss=0xbf8d508c, u=..., e=green)
                 at frame-args.c:23

     'none'
          None of the argument values are printed.  Instead, the value
          of each argument is replaced by '...'.  In this case, the
          example above now becomes:

               #1  0x08048361 in call_me (i=..., s=..., ss=..., u=..., e=...)
                 at frame-args.c:23

     'presence'
          Only the presence of arguments is indicated by '...'.  The
          '...' are not printed for function without any arguments.
          None of the argument names and values are printed.  In this
          case, the example above now becomes:

               #1  0x08048361 in call_me (...) at frame-args.c:23

     By default, only scalar arguments are printed.  This command can be
     used to configure the debugger to print the value of all arguments,
     regardless of their type.  However, it is often advantageous to not
     print the value of more complex parameters.  For instance, it
     reduces the amount of information printed in each frame, making the
     backtrace more readable.  Also, it improves performance when
     displaying Ada frames, because the computation of large arguments
     can sometimes be CPU-intensive, especially in large applications.
     Setting 'print frame-arguments' to 'scalars' (the default), 'none'
     or 'presence' avoids this computation, thus speeding up the display
     of each Ada frame.

'show print frame-arguments'
     Show how the value of arguments should be displayed when printing a
     frame.

'set print raw-frame-arguments on'
     Print frame arguments in raw, non pretty-printed, form.

'set print raw-frame-arguments off'
     Print frame arguments in pretty-printed form, if there is a
     pretty-printer for the value (see Pretty Printing), otherwise
     print the value in raw form.  This is the default.

'show print raw-frame-arguments'
     Show whether to print frame arguments in raw form.

'set print entry-values VALUE'
     Set printing of frame argument values at function entry.  In some
     cases GDB can determine the value of function argument which was
     passed by the function caller, even if the value was modified
     inside the called function and therefore is different.  With
     optimized code, the current value could be unavailable, but the
     entry value may still be known.

     The default value is 'default' (see below for its description).
     Older GDB behaved as with the setting 'no'.  Compilers not
     supporting this feature will behave in the 'default' setting the
     same way as with the 'no' setting.

     This functionality is currently supported only by DWARF 2 debugging
     format and the compiler has to produce 'DW_TAG_call_site' tags.
     With GCC, you need to specify '-O -g' during compilation, to get
     this information.

     The VALUE parameter can be one of the following:

     'no'
          Print only actual parameter values, never print values from
          function entry point.
               #0  equal (val=5)
               #0  different (val=6)
               #0  lost (val=<optimized out>)
               #0  born (val=10)
               #0  invalid (val=<optimized out>)

     'only'
          Print only parameter values from function entry point.  The
          actual parameter values are never printed.
               #0  equal (val@entry=5)
               #0  different (val@entry=5)
               #0  lost (val@entry=5)
               #0  born (val@entry=<optimized out>)
               #0  invalid (val@entry=<optimized out>)

     'preferred'
          Print only parameter values from function entry point.  If
          value from function entry point is not known while the actual
          value is known, print the actual value for such parameter.
               #0  equal (val@entry=5)
               #0  different (val@entry=5)
               #0  lost (val@entry=5)
               #0  born (val=10)
               #0  invalid (val@entry=<optimized out>)

     'if-needed'
          Print actual parameter values.  If actual parameter value is
          not known while value from function entry point is known,
          print the entry point value for such parameter.
               #0  equal (val=5)
               #0  different (val=6)
               #0  lost (val@entry=5)
               #0  born (val=10)
               #0  invalid (val=<optimized out>)

     'both'
          Always print both the actual parameter value and its value
          from function entry point, even if values of one or both are
          not available due to compiler optimizations.
               #0  equal (val=5, val@entry=5)
               #0  different (val=6, val@entry=5)
               #0  lost (val=<optimized out>, val@entry=5)
               #0  born (val=10, val@entry=<optimized out>)
               #0  invalid (val=<optimized out>, val@entry=<optimized out>)

     'compact'
          Print the actual parameter value if it is known and also its
          value from function entry point if it is known.  If neither is
          known, print for the actual value '<optimized out>'.  If not
          in MI mode (see GDB/MI) and if both values are known and
          identical, print the shortened 'param=param@entry=VALUE'
          notation.
               #0  equal (val=val@entry=5)
               #0  different (val=6, val@entry=5)
               #0  lost (val@entry=5)
               #0  born (val=10)
               #0  invalid (val=<optimized out>)

     'default'
          Always print the actual parameter value.  Print also its value
          from function entry point, but only if it is known.  If not in
          MI mode (see GDB/MI) and if both values are known and
          identical, print the shortened 'param=param@entry=VALUE'
          notation.
               #0  equal (val=val@entry=5)
               #0  different (val=6, val@entry=5)
               #0  lost (val=<optimized out>, val@entry=5)
               #0  born (val=10)
               #0  invalid (val=<optimized out>)

     For analysis messages on possible failures of frame argument values
     at function entry resolution see set debug entry-values.

'show print entry-values'
     Show the method being used for printing of frame argument values at
     function entry.

'set print frame-info VALUE'
     This command allows to control the information printed when the
     debugger prints a frame.  See Frames, Backtrace,
     for a general explanation about frames and frame information.  Note
     that some other settings (such as 'set print frame-arguments' and
     'set print address') are also influencing if and how some frame
     information is displayed.  In particular, the frame program counter
     is never printed if 'set print address' is off.

     The possible values for 'set print frame-info' are:
     'short-location'
          Print the frame level, the program counter (if not at the
          beginning of the location source line), the function, the
          function arguments.
     'location'
          Same as 'short-location' but also print the source file and
          source line number.
     'location-and-address'
          Same as 'location' but print the program counter even if
          located at the beginning of the location source line.
     'source-line'
          Print the program counter (if not at the beginning of the
          location source line), the line number and the source line.
     'source-and-location'
          Print what 'location' and 'source-line' are printing.
     'auto'
          The information printed for a frame is decided automatically
          by the GDB command that prints a frame.  For example, 'frame'
          prints the information printed by 'source-and-location' while
          'stepi' will switch between 'source-line' and
          'source-and-location' depending on the program counter.  The
          default value is 'auto'.

'set print repeats NUMBER-OF-REPEATS'
'set print repeats unlimited'
     Set the threshold for suppressing display of repeated array
     elements.  When the number of consecutive identical elements of an
     array exceeds the threshold, GDB prints the string '"<repeats N
     times>"', where N is the number of identical repetitions, instead
     of displaying the identical elements themselves.  Setting the
     threshold to 'unlimited' or zero will cause all elements to be
     individually printed.  The default threshold is 10.

'show print repeats'
     Display the current threshold for printing repeated identical
     elements.

'set print max-depth DEPTH'
'set print max-depth unlimited'
     Set the threshold after which nested structures are replaced with
     ellipsis, this can make visualising deeply nested structures
     easier.

     For example, given this C code

          typedef struct s1 { int a; } s1;
          typedef struct s2 { s1 b; } s2;
          typedef struct s3 { s2 c; } s3;
          typedef struct s4 { s3 d; } s4;

          s4 var = { { { { 3 } } } };

     The following table shows how different values of DEPTH will effect
     how 'var' is printed by GDB:

     DEPTH setting          Result of 'p var'
     --------------------------------------------------------------------------
     unlimited              '$1 = {d = {c = {b = {a = 3}}}}'
     '0'                    '$1 = {...}'
     '1'                    '$1 = {d = {...}}'
     '2'                    '$1 = {d = {c = {...}}}'
     '3'                    '$1 = {d = {c = {b = {...}}}}'
     '4'                    '$1 = {d = {c = {b = {a = 3}}}}'

     To see the contents of structures that have been hidden the user
     can either increase the print max-depth, or they can print the
     elements of the structure that are visible, for example

          (gdb) set print max-depth 2
          (gdb) p var
          $1 = {d = {c = {...}}}
          (gdb) p var.d
          $2 = {c = {b = {...}}}
          (gdb) p var.d.c
          $3 = {b = {a = 3}}

     The pattern used to replace nested structures varies based on
     language, for most languages '{...}' is used, but Fortran uses
     '(...)'.

'show print max-depth'
     Display the current threshold after which nested structures are
     replaces with ellipsis.

'set print memory-tag-violations'
'set print memory-tag-violations on'
     Cause GDB to display additional information about memory tag
     violations when printing pointers and addresses.

'set print memory-tag-violations off'
     Stop printing memory tag violation information.

'show print memory-tag-violations'
     Show whether memory tag violation information is displayed when
     printing pointers and addresses.

'set print null-stop'
     Cause GDB to stop printing the characters of an array when the
     first NULL is encountered.  This is useful when large arrays
     actually contain only short strings.  The default is off.

'show print null-stop'
     Show whether GDB stops printing an array on the first NULL
     character.

'set print pretty on'
     Cause GDB to print structures in an indented format with one member
     per line, like this:

          $1 = {
            next = 0x0,
            flags = {
              sweet = 1,
              sour = 1
            },
            meat = 0x54 "Pork"
          }

'set print pretty off'
     Cause GDB to print structures in a compact format, like this:

          $1 = {next = 0x0, flags = {sweet = 1, sour = 1}, \
          meat = 0x54 "Pork"}

     This is the default format.

'show print pretty'
     Show which format GDB is using to print structures.

'set print raw-values on'
     Print values in raw form, without applying the pretty printers for
     the value.

'set print raw-values off'
     Print values in pretty-printed form, if there is a pretty-printer
     for the value (see Pretty Printing), otherwise print the value
     in raw form.

     The default setting is "off".

'show print raw-values'
     Show whether to print values in raw form.

'set print sevenbit-strings on'
     Print using only seven-bit characters; if this option is set, GDB
     displays any eight-bit characters (in strings or character values)
     using the notation '\'NNN.  This setting is best if you are working
     in English (ASCII) and you use the high-order bit of characters as
     a marker or "meta" bit.

'set print sevenbit-strings off'
     Print full eight-bit characters.  This allows the use of more
     international character sets, and is the default.

'show print sevenbit-strings'
     Show whether or not GDB is printing only seven-bit characters.

'set print union on'
     Tell GDB to print unions which are contained in structures and
     other unions.  This is the default setting.

'set print union off'
     Tell GDB not to print unions which are contained in structures and
     other unions.  GDB will print '"{...}"' instead.

'show print union'
     Ask GDB whether or not it will print unions which are contained in
     structures and other unions.

     For example, given the declarations

          typedef enum {Tree, Bug} Species;
          typedef enum {Big_tree, Acorn, Seedling} Tree_forms;
          typedef enum {Caterpillar, Cocoon, Butterfly}
                        Bug_forms;

          struct thing {
            Species it;
            union {
              Tree_forms tree;
              Bug_forms bug;
            } form;
          };

          struct thing foo = {Tree, {Acorn}};

     with 'set print union on' in effect 'p foo' would print

          $1 = {it = Tree, form = {tree = Acorn, bug = Cocoon}}

     and with 'set print union off' in effect it would print

          $1 = {it = Tree, form = {...}}

     'set print union' affects programs written in C-like languages and
     in Pascal.

These settings are of interest when debugging C++ programs:

'set print demangle'
'set print demangle on'
     Print C++ names in their source form rather than in the encoded
     ("mangled") form passed to the assembler and linker for type-safe
     linkage.  The default is on.

'show print demangle'
     Show whether C++ names are printed in mangled or demangled form.

'set print asm-demangle'
'set print asm-demangle on'
     Print C++ names in their source form rather than their mangled
     form, even in assembler code printouts such as instruction
     disassemblies.  The default is off.

'show print asm-demangle'
     Show whether C++ names in assembly listings are printed in mangled
     or demangled form.

'set demangle-style STYLE'
     Choose among several encoding schemes used by different compilers
     to represent C++ names.  If you omit STYLE, you will see a list of
     possible formats.  The default value is AUTO, which lets GDB choose
     a decoding style by inspecting your program.

'show demangle-style'
     Display the encoding style currently in use for decoding C++
     symbols.

'set print object'
'set print object on'
     When displaying a pointer to an object, identify the _actual_
     (derived) type of the object rather than the _declared_ type, using
     the virtual function table.  Note that the virtual function table
     is required--this feature can only work for objects that have
     run-time type identification; a single virtual method in the
     object's declared type is sufficient.  Note that this setting is
     also taken into account when working with variable objects via MI
     (see GDB/MI).

'set print object off'
     Display only the declared type of objects, without reference to the
     virtual function table.  This is the default setting.

'show print object'
     Show whether actual, or declared, object types are displayed.

'set print static-members'
'set print static-members on'
     Print static members when displaying a C++ object.  The default is
     on.

'set print static-members off'
     Do not print static members when displaying a C++ object.

'show print static-members'
     Show whether C++ static members are printed or not.

'set print pascal_static-members'
'set print pascal_static-members on'
     Print static members when displaying a Pascal object.  The default
     is on.

'set print pascal_static-members off'
     Do not print static members when displaying a Pascal object.

'show print pascal_static-members'
     Show whether Pascal static members are printed or not.

'set print vtbl'
'set print vtbl on'
     Pretty print C++ virtual function tables.  The default is off.
     (The 'vtbl' commands do not work on programs compiled with the HP
     ANSI C++ compiler ('aCC').)

'set print vtbl off'
     Do not pretty print C++ virtual function tables.

'show print vtbl'
     Show whether C++ virtual function tables are pretty printed, or
     not.

10.10 Pretty Printing
=====================

GDB provides a mechanism to allow pretty-printing of values using Python
code.  It greatly simplifies the display of complex objects.  This
mechanism works for both MI and the CLI.

10.10.1 Pretty-Printer Introduction
-----------------------------------

When GDB prints a value, it first sees if there is a pretty-printer
registered for the value.  If there is then GDB invokes the
pretty-printer to print the value.  Otherwise the value is printed
normally.

   Pretty-printers are normally named.  This makes them easy to manage.
The 'info pretty-printer' command will list all the installed
pretty-printers with their names.  If a pretty-printer can handle
multiple data types, then its "subprinters" are the printers for the
individual data types.  Each such subprinter has its own name.  The
format of the name is PRINTER-NAME;SUBPRINTER-NAME.

   Pretty-printers are installed by "registering" them with GDB.
Typically they are automatically loaded and registered when the
corresponding debug information is loaded, thus making them available
without having to do anything special.

   There are three places where a pretty-printer can be registered.

   * Pretty-printers registered globally are available when debugging
     all inferiors.

   * Pretty-printers registered with a program space are available only
     when debugging that program.  See Progspaces In Python, for
     more details on program spaces in Python.

   * Pretty-printers registered with an objfile are loaded and unloaded
     with the corresponding objfile (e.g., shared library).  See
     Objfiles In Python, for more details on objfiles in Python.

   See Selecting Pretty-Printers, for further information on how
pretty-printers are selected,

   See Writing a Pretty-Printer, for implementing pretty printers
for new types.

10.10.2 Pretty-Printer Example
------------------------------

Here is how a C++ 'std::string' looks without a pretty-printer:

     (gdb) print s
     $1 = {
       static npos = 4294967295,
       _M_dataplus = {
         <std::allocator<char>> = {
           <__gnu_cxx::new_allocator<char>> = {
             <No data fields>}, <No data fields>
           },
         members of std::basic_string<char, std::char_traits<char>,
           std::allocator<char> >::_Alloc_hider:
         _M_p = 0x804a014 "abcd"
       }
     }

   With a pretty-printer for 'std::string' only the contents are
printed:

     (gdb) print s
     $2 = "abcd"

10.10.3 Pretty-Printer Commands
-------------------------------

'info pretty-printer [OBJECT-REGEXP [NAME-REGEXP]]'
     Print the list of installed pretty-printers.  This includes
     disabled pretty-printers, which are marked as such.

     OBJECT-REGEXP is a regular expression matching the objects whose
     pretty-printers to list.  Objects can be 'global', the program
     space's file (see Progspaces In Python), and the object files
     within that program space (see Objfiles In Python).  See
     Selecting Pretty-Printers, for details on how GDB looks up a
     printer from these three objects.

     NAME-REGEXP is a regular expression matching the name of the
     printers to list.

'disable pretty-printer [OBJECT-REGEXP [NAME-REGEXP]]'
     Disable pretty-printers matching OBJECT-REGEXP and NAME-REGEXP.  A
     disabled pretty-printer is not forgotten, it may be enabled again
     later.

'enable pretty-printer [OBJECT-REGEXP [NAME-REGEXP]]'
     Enable pretty-printers matching OBJECT-REGEXP and NAME-REGEXP.

   Example:

   Suppose we have three pretty-printers installed: one from library1.so
named 'foo' that prints objects of type 'foo', and another from
library2.so named 'bar' that prints two types of objects, 'bar1' and
'bar2'.

     (gdb) info pretty-printer
     library1.so:
       foo
     library2.so:
       bar
         bar1
         bar2
     (gdb) info pretty-printer library2
     library2.so:
       bar
         bar1
         bar2
     (gdb) disable pretty-printer library1
     1 printer disabled
     2 of 3 printers enabled
     (gdb) info pretty-printer
     library1.so:
       foo [disabled]
     library2.so:
       bar
         bar1
         bar2
     (gdb) disable pretty-printer library2 bar;bar1
     1 printer disabled
     1 of 3 printers enabled
     (gdb) info pretty-printer library2
     library2.so:
       bar
         bar1 [disabled]
         bar2
     (gdb) disable pretty-printer library2 bar
     1 printer disabled
     0 of 3 printers enabled
     (gdb) info pretty-printer
     library1.so:
       foo [disabled]
     library2.so:
       bar [disabled]
         bar1 [disabled]
         bar2

   Note that for 'bar' the entire printer can be disabled, as can each
individual subprinter.

   Printing values and frame arguments is done by default using the
enabled pretty printers.

   The print option '-raw-values' and GDB setting 'set print raw-values'
(see set print raw-values) can be used to print values without
applying the enabled pretty printers.

   Similarly, the backtrace option '-raw-frame-arguments' and GDB
setting 'set print raw-frame-arguments' (see set print raw-frame-arguments)
can be used to ignore the enabled pretty printers
when printing frame argument values.

10.11 Value History
===================

Values printed by the 'print' command are saved in the GDB "value
history".  This allows you to refer to them in other expressions.
Values are kept until the symbol table is re-read or discarded (for
example with the 'file' or 'symbol-file' commands).  When the symbol
table changes, the value history is discarded, since the values may
contain pointers back to the types defined in the symbol table.

   The values printed are given "history numbers" by which you can refer
to them.  These are successive integers starting with one.  'print'
shows you the history number assigned to a value by printing '$NUM = '
before the value; here NUM is the history number.

   To refer to any previous value, use '$' followed by the value's
history number.  The way 'print' labels its output is designed to remind
you of this.  Just '$' refers to the most recent value in the history,
and '$$' refers to the value before that.  '$$N' refers to the Nth value
from the end; '$$2' is the value just prior to '$$', '$$1' is equivalent
to '$$', and '$$0' is equivalent to '$'.

   For example, suppose you have just printed a pointer to a structure
and want to see the contents of the structure.  It suffices to type

     p *$

   If you have a chain of structures where the component 'next' points
to the next one, you can print the contents of the next one with this:

     p *$.next

You can print successive links in the chain by repeating this
command--which you can do by just typing <RET>.

   Note that the history records values, not expressions.  If the value
of 'x' is 4 and you type these commands:

     print x
     set x=5

then the value recorded in the value history by the 'print' command
remains 4 even though the value of 'x' has changed.

'show values'
     Print the last ten values in the value history, with their item
     numbers.  This is like 'p $$9' repeated ten times, except that
     'show values' does not change the history.

'show values N'
     Print ten history values centered on history item number N.

'show values +'
     Print ten history values just after the values last printed.  If no
     more values are available, 'show values +' produces no display.

   Pressing <RET> to repeat 'show values N' has exactly the same effect
as 'show values +'.

10.12 Convenience Variables
===========================

GDB provides "convenience variables" that you can use within GDB to hold
on to a value and refer to it later.  These variables exist entirely
within GDB; they are not part of your program, and setting a convenience
variable has no direct effect on further execution of your program.
That is why you can use them freely.

   Convenience variables are prefixed with '$'.  Any name preceded by
'$' can be used for a convenience variable, unless it is one of the
predefined machine-specific register names (see Registers).
(Value history references, in contrast, are _numbers_
preceded by '$'.  See Value History.)

   You can save a value in a convenience variable with an assignment
expression, just as you would set a variable in your program.  For
example:

     set $foo = *object_ptr

would save in '$foo' the value contained in the object pointed to by
'object_ptr'.

   Using a convenience variable for the first time creates it, but its
value is 'void' until you assign a new value.  You can alter the value
with another assignment at any time.

   Convenience variables have no fixed types.  You can assign a
convenience variable any type of value, including structures and arrays,
even if that variable already has a value of a different type.  The
convenience variable, when used as an expression, has the type of its
current value.

'show convenience'
     Print a list of convenience variables used so far, and their
     values, as well as a list of the convenience functions.
     Abbreviated 'show conv'.

'init-if-undefined $VARIABLE = EXPRESSION'
     Set a convenience variable if it has not already been set.  This is
     useful for user-defined commands that keep some state.  It is
     similar, in concept, to using local static variables with
     initializers in C (except that convenience variables are global).
     It can also be used to allow users to override default values used
     in a command script.

     If the variable is already defined then the expression is not
     evaluated so any side-effects do not occur.

   One of the ways to use a convenience variable is as a counter to be
incremented or a pointer to be advanced.  For example, to print a field
from successive elements of an array of structures:

     set $i = 0
     print bar[$i++]->contents

Repeat that command by typing <RET>.

   Some convenience variables are created automatically by GDB and given
values likely to be useful.

'$_'
     The variable '$_' is automatically set by the 'x' command to the
     last address examined (see Examining Memory).  Other
     commands which provide a default address for 'x' to examine also
     set '$_' to that address; these commands include 'info line' and
     'info breakpoint'.  The type of '$_' is 'void *' except when set by
     the 'x' command, in which case it is a pointer to the type of
     '$__'.

'$__'
     The variable '$__' is automatically set by the 'x' command to the
     value found in the last address examined.  Its type is chosen to
     match the format in which the data was printed.

'$_exitcode'
     When the program being debugged terminates normally, GDB
     automatically sets this variable to the exit code of the program,
     and resets '$_exitsignal' to 'void'.

'$_exitsignal'
     When the program being debugged dies due to an uncaught signal, GDB
     automatically sets this variable to that signal's number, and
     resets '$_exitcode' to 'void'.

     To distinguish between whether the program being debugged has
     exited (i.e., '$_exitcode' is not 'void') or signalled (i.e.,
     '$_exitsignal' is not 'void'), the convenience function '$_isvoid'
     can be used (see Convenience Functions).  For
     example, considering the following source code:

          #include <signal.h>

          int
          main (int argc, char *argv[])
          {
            raise (SIGALRM);
            return 0;
          }

     A valid way of telling whether the program being debugged has
     exited or signalled would be:

          (gdb) define has_exited_or_signalled
          Type commands for definition of ``has_exited_or_signalled''.
          End with a line saying just ``end''.
          >if $_isvoid ($_exitsignal)
           >echo The program has exited\n
           >else
           >echo The program has signalled\n
           >end
          >end
          (gdb) run
          Starting program:

          Program terminated with signal SIGALRM, Alarm clock.
          The program no longer exists.
          (gdb) has_exited_or_signalled
          The program has signalled

     As can be seen, GDB correctly informs that the program being
     debugged has signalled, since it calls 'raise' and raises a
     'SIGALRM' signal.  If the program being debugged had not called
     'raise', then GDB would report a normal exit:

          (gdb) has_exited_or_signalled
          The program has exited

'$_exception'
     The variable '$_exception' is set to the exception object being
     thrown at an exception-related catchpoint.  See Set Catchpoints.

'$_ada_exception'
     The variable '$_ada_exception' is set to the address of the
     exception being caught or thrown at an Ada exception-related
     catchpoint.  See Set Catchpoints.

'$_probe_argc'
'$_probe_arg0...$_probe_arg11'
     Arguments to a static probe.  See Static Probe Points.

'$_sdata'
     The variable '$_sdata' contains extra collected static tracepoint
     data.  See Tracepoint Action Lists.  Note
     that '$_sdata' could be empty, if not inspecting a trace buffer, or
     if extra static tracepoint data has not been collected.

'$_siginfo'
     The variable '$_siginfo' contains extra signal information (see
     extra signal information).  Note that '$_siginfo' could be empty,
     if the application has not yet received any signals.  For example,
     it will be empty before you execute the 'run' command.

'$_tlb'
     The variable '$_tlb' is automatically set when debugging
     applications running on MS-Windows in native mode or connected to
     gdbserver that supports the 'qGetTIBAddr' request.  See General Query Packets.
     This variable contains the address of the thread
     information block.

'$_inferior'
     The number of the current inferior.  See Debugging Multiple Inferiors Connections and Programs.

'$_thread'
     The thread number of the current thread.  See thread numbers.

'$_gthread'
     The global number of the current thread.  See global thread numbers.

'$_inferior_thread_count'
     The number of live threads in the current inferior.  See
     Threads.

'$_gdb_major'
'$_gdb_minor'
     The major and minor version numbers of the running GDB.
     Development snapshots and pretest versions have their minor version
     incremented by one; thus, GDB pretest 9.11.90 will produce the
     value 12 for '$_gdb_minor'.  These variables allow you to write
     scripts that work with different versions of GDB without errors
     caused by features unavailable in some of those versions.

'$_shell_exitcode'
'$_shell_exitsignal'
     GDB commands such as 'shell' and '|' are launching shell commands.
     When a launched command terminates, GDB automatically maintains the
     variables '$_shell_exitcode' and '$_shell_exitsignal' according to
     the exit status of the last launched command.  These variables are
     set and used similarly to the variables '$_exitcode' and
     '$_exitsignal'.

10.13 Convenience Functions
===========================

GDB also supplies some "convenience functions".  These have a syntax
similar to convenience variables.  A convenience function can be used in
an expression just like an ordinary function; however, a convenience
function is implemented internally to GDB.

   These functions do not require GDB to be configured with 'Python'
support, which means that they are always available.

'$_isvoid (EXPR)'
     Return one if the expression EXPR is 'void'.  Otherwise it returns
     zero.

     A 'void' expression is an expression where the type of the result
     is 'void'.  For example, you can examine a convenience variable
     (see Convenience Variables) to check
     whether it is 'void':

          (gdb) print $_exitcode
          $1 = void
          (gdb) print $_isvoid ($_exitcode)
          $2 = 1
          (gdb) run
          Starting program: ./a.out
          [Inferior 1 (process 29572) exited normally]
          (gdb) print $_exitcode
          $3 = 0
          (gdb) print $_isvoid ($_exitcode)
          $4 = 0

     In the example above, we used '$_isvoid' to check whether
     '$_exitcode' is 'void' before and after the execution of the
     program being debugged.  Before the execution there is no exit code
     to be examined, therefore '$_exitcode' is 'void'.  After the
     execution the program being debugged returned zero, therefore
     '$_exitcode' is zero, which means that it is not 'void' anymore.

     The 'void' expression can also be a call of a function from the
     program being debugged.  For example, given the following function:

          void
          foo (void)
          {
          }

     The result of calling it inside GDB is 'void':

          (gdb) print foo ()
          $1 = void
          (gdb) print $_isvoid (foo ())
          $2 = 1
          (gdb) set $v = foo ()
          (gdb) print $v
          $3 = void
          (gdb) print $_isvoid ($v)
          $4 = 1

'$_gdb_setting_str (SETTING)'
     Return the value of the GDB SETTING as a string.  SETTING is any
     setting that can be used in a 'set' or 'show' command (see
     Controlling GDB).

          (gdb) show print frame-arguments
          Printing of non-scalar frame arguments is "scalars".
          (gdb) p $_gdb_setting_str("print frame-arguments")
          $1 = "scalars"
          (gdb) p $_gdb_setting_str("height")
          $2 = "30"
          (gdb)

'$_gdb_setting (SETTING)'
     Return the value of the GDB SETTING.  The type of the returned
     value depends on the setting.

     The value type for boolean and auto boolean settings is 'int'.  The
     boolean values 'off' and 'on' are converted to the integer values
     '0' and '1'.  The value 'auto' is converted to the value '-1'.

     The value type for integer settings is either 'unsigned int' or
     'int', depending on the setting.

     Some integer settings accept an 'unlimited' value.  Depending on
     the setting, the 'set' command also accepts the value '0' or the
     value '-1' as a synonym for 'unlimited'.  For example, 'set height
     unlimited' is equivalent to 'set height 0'.

     Some other settings that accept the 'unlimited' value use the value
     '0' to literally mean zero.  For example, 'set history size 0'
     indicates to not record any GDB commands in the command history.
     For such settings, '-1' is the synonym for 'unlimited'.

     See the documentation of the corresponding 'set' command for the
     numerical value equivalent to 'unlimited'.

     The '$_gdb_setting' function converts the unlimited value to a '0'
     or a '-1' value according to what the 'set' command uses.

          (gdb) p $_gdb_setting_str("height")
          $1 = "30"
          (gdb) p $_gdb_setting("height")
          $2 = 30
          (gdb) set height unlimited
          (gdb) p $_gdb_setting_str("height")
          $3 = "unlimited"
          (gdb) p $_gdb_setting("height")
          $4 = 0
          (gdb) p $_gdb_setting_str("history size")
          $5 = "unlimited"
          (gdb) p $_gdb_setting("history size")
          $6 = -1
          (gdb) p $_gdb_setting_str("disassemble-next-line")
          $7 = "auto"
          (gdb) p $_gdb_setting("disassemble-next-line")
          $8 = -1
          (gdb)

     Other setting types (enum, filename, optional filename, string,
     string noescape) are returned as string values.

'$_gdb_maint_setting_str (SETTING)'
     Like the '$_gdb_setting_str' function, but works with 'maintenance
     set' variables.

'$_gdb_maint_setting (SETTING)'
     Like the '$_gdb_setting' function, but works with 'maintenance set'
     variables.

'$_shell (COMMAND-STRING)'

     Invoke a shell to execute COMMAND-STRING.  COMMAND-STRING must be a
     string.  The shell runs on the host machine, the machine GDB is
     running on.  Returns the command's exit status.  On Unix systems, a
     command which exits with a zero exit status has succeeded, and
     non-zero exit status indicates failure.  When a command terminates
     on a fatal signal whose number is N, GDB uses the value 128+N as
     the exit status, as is standard in Unix shells.  Note that N is a
     host signal number, not a target signal number.  If you're native
     debugging, they will be the same, but if cross debugging, the host
     vs target signal numbers may be completely unrelated.  Please
     consult your host operating system's documentation for the mapping
     between host signal numbers and signal names.  The shell to run is
     determined in the same way as for the 'shell' command.  See Shell Commands.

          (gdb) print $_shell("true")
          $1 = 0
          (gdb) print $_shell("false")
          $2 = 1
          (gdb) p $_shell("echo hello")
          hello
          $3 = 0
          (gdb) p $_shell("foobar")
          bash: line 1: foobar: command not found
          $4 = 127

     This may also be useful in breakpoint conditions.  For example:

          (gdb) break function if $_shell("some command") == 0

     In this scenario, you'll want to make sure that the shell command
     you run in the breakpoint condition takes the least amount of time
     possible.  For example, avoid running a command that may block
     indefinitely, or that sleeps for a while before exiting.  Prefer a
     command or script which analyzes some state and exits immediately.
     This is important because the debugged program stops for the
     breakpoint every time, and then GDB evaluates the breakpoint
     condition.  If the condition is false, the program is re-resumed
     transparently, without informing you of the stop.  A quick shell
     command thus avoids significantly slowing down the debugged program
     unnecessarily.

     Note: unlike the 'shell' command, the '$_shell' convenience
     function does not affect the '$_shell_exitcode' and
     '$_shell_exitsignal' convenience variables.

   The following functions require GDB to be configured with 'Python'
support.

'$_memeq(BUF1, BUF2, LENGTH)'
     Returns one if the LENGTH bytes at the addresses given by BUF1 and
     BUF2 are equal.  Otherwise it returns zero.

'$_regex(STR, REGEX)'
     Returns one if the string STR matches the regular expression REGEX.
     Otherwise it returns zero.  The syntax of the regular expression is
     that specified by 'Python''s regular expression support.

'$_streq(STR1, STR2)'
     Returns one if the strings STR1 and STR2 are equal.  Otherwise it
     returns zero.

'$_strlen(STR)'
     Returns the length of string STR.

'$_caller_is(NAME[, NUMBER_OF_FRAMES])'
     Returns one if the calling function's name is equal to NAME.
     Otherwise it returns zero.

     If the optional argument NUMBER_OF_FRAMES is provided, it is the
     number of frames up in the stack to look.  The default is 1.

     Example:

          (gdb) backtrace
          #0  bottom_func ()
              at testsuite/gdb.python/py-caller-is.c:21
          #1  0x00000000004005a0 in middle_func ()
              at testsuite/gdb.python/py-caller-is.c:27
          #2  0x00000000004005ab in top_func ()
              at testsuite/gdb.python/py-caller-is.c:33
          #3  0x00000000004005b6 in main ()
              at testsuite/gdb.python/py-caller-is.c:39
          (gdb) print $_caller_is ("middle_func")
          $1 = 1
          (gdb) print $_caller_is ("top_func", 2)
          $1 = 1

'$_caller_matches(REGEXP[, NUMBER_OF_FRAMES])'
     Returns one if the calling function's name matches the regular
     expression REGEXP.  Otherwise it returns zero.

     If the optional argument NUMBER_OF_FRAMES is provided, it is the
     number of frames up in the stack to look.  The default is 1.

'$_any_caller_is(NAME[, NUMBER_OF_FRAMES])'
     Returns one if any calling function's name is equal to NAME.
     Otherwise it returns zero.

     If the optional argument NUMBER_OF_FRAMES is provided, it is the
     number of frames up in the stack to look.  The default is 1.

     This function differs from '$_caller_is' in that this function
     checks all stack frames from the immediate caller to the frame
     specified by NUMBER_OF_FRAMES, whereas '$_caller_is' only checks
     the frame specified by NUMBER_OF_FRAMES.

'$_any_caller_matches(REGEXP[, NUMBER_OF_FRAMES])'
     Returns one if any calling function's name matches the regular
     expression REGEXP.  Otherwise it returns zero.

     If the optional argument NUMBER_OF_FRAMES is provided, it is the
     number of frames up in the stack to look.  The default is 1.

     This function differs from '$_caller_matches' in that this function
     checks all stack frames from the immediate caller to the frame
     specified by NUMBER_OF_FRAMES, whereas '$_caller_matches' only
     checks the frame specified by NUMBER_OF_FRAMES.

'$_as_string(VALUE)'
     This convenience function is considered deprecated, and could be
     removed from future versions of GDB.  Use the '%V' format specifier
     instead (see %V Format Specifier).

     Return the string representation of VALUE.

     This function is useful to obtain the textual label (enumerator) of
     an enumeration value.  For example, assuming the variable NODE is
     of an enumerated type:

          (gdb) printf "Visiting node of type %s\n", $_as_string(node)
          Visiting node of type NODE_INTEGER

'$_cimag(VALUE)'
'$_creal(VALUE)'
     Return the imaginary ('$_cimag') or real ('$_creal') part of the
     complex number VALUE.

     The type of the imaginary or real part depends on the type of the
     complex number, e.g., using '$_cimag' on a 'float complex' will
     return an imaginary part of type 'float'.

   GDB provides the ability to list and get help on convenience
functions.

'help function'
     Print a list of all convenience functions.

10.14 Registers
===============

You can refer to machine register contents, in expressions, as variables
with names starting with '$'.  The names of registers are different for
each machine; use 'info registers' to see the names used on your
machine.

'info registers'
     Print the names and values of all registers except floating-point
     and vector registers (in the selected stack frame).

'info all-registers'
     Print the names and values of all registers, including
     floating-point and vector registers (in the selected stack frame).

'info registers REGGROUP ...'
     Print the name and value of the registers in each of the specified
     REGGROUPs.  The REGGROUP can be any of those returned by 'maint
     print reggroups' (see Maintenance Commands).

'info registers REGNAME ...'
     Print the "relativized" value of each specified register REGNAME.
     As discussed in detail below, register values are normally relative
     to the selected stack frame.  The REGNAME may be any register name
     valid on the machine you are using, with or without the initial
     '$'.

   GDB has four "standard" register names that are available (in
expressions) on most machines--whenever they do not conflict with an
architecture's canonical mnemonics for registers.  The register names
'$pc' and '$sp' are used for the program counter register and the stack
pointer.  '$fp' is used for a register that contains a pointer to the
current stack frame, and '$ps' is used for a register that contains the
processor status.  For example, you could print the program counter in
hex with

     p/x $pc

or print the instruction to be executed next with

     x/i $pc

or add four to the stack pointer(1) with

     set $sp += 4

   Whenever possible, these four standard register names are available
on your machine even though the machine has different canonical
mnemonics, so long as there is no conflict.  The 'info registers'
command shows the canonical names.  For example, on the SPARC, 'info
registers' displays the processor status register as '$psr' but you can
also refer to it as '$ps'; and on x86-based machines '$ps' is an alias
for the EFLAGS register.

   GDB always considers the contents of an ordinary register as an
integer when the register is examined in this way.  Some machines have
special registers which can hold nothing but floating point; these
registers are considered to have floating point values.  There is no way
to refer to the contents of an ordinary register as floating point value
(although you can _print_ it as a floating point value with 'print/f
$REGNAME').

   Some registers have distinct "raw" and "virtual" data formats.  This
means that the data format in which the register contents are saved by
the operating system is not the same one that your program normally
sees.  For example, the registers of the 68881 floating point
coprocessor are always saved in "extended" (raw) format, but all C
programs expect to work with "double" (virtual) format.  In such cases,
GDB normally works with the virtual format only (the format that makes
sense for your program), but the 'info registers' command prints the
data in both formats.

   Some machines have special registers whose contents can be
interpreted in several different ways.  For example, modern x86-based
machines have SSE and MMX registers that can hold several values packed
together in several different formats.  GDB refers to such registers in
'struct' notation:

     (gdb) print $xmm1
     $1 = {
       v4_float = {0, 3.43859137e-038, 1.54142831e-044, 1.821688e-044},
       v2_double = {9.92129282474342e-303, 2.7585945287983262e-313},
       v16_int8 = "\000\000\000\000\3706;\001\v\000\000\000\r\000\000",
       v8_int16 = {0, 0, 14072, 315, 11, 0, 13, 0},
       v4_int32 = {0, 20657912, 11, 13},
       v2_int64 = {88725056443645952, 55834574859},
       uint128 = 0x0000000d0000000b013b36f800000000
     }

To set values of such registers, you need to tell GDB which view of the
register you wish to change, as if you were assigning value to a
'struct' member:

      (gdb) set $xmm1.uint128 = 0x000000000000000000000000FFFFFFFF

   Normally, register values are relative to the selected stack frame
(see Selecting a Frame).  This means that you get the
value that the register would contain if all stack frames farther in
were exited and their saved registers restored.  In order to see the
true contents of hardware registers, you must select the innermost frame
(with 'frame 0').

   Usually ABIs reserve some registers as not needed to be saved by the
callee (a.k.a.: "caller-saved", "call-clobbered" or "volatile"
registers).  It may therefore not be possible for GDB to know the value
a register had before the call (in other words, in the outer frame), if
the register value has since been changed by the callee.  GDB tries to
deduce where the inner frame saved ("callee-saved") registers, from the
debug info, unwind info, or the machine code generated by your compiler.
If some register is not saved, and GDB knows the register is
"caller-saved" (via its own knowledge of the ABI, or because the
debug/unwind info explicitly says the register's value is undefined),
GDB displays '<not saved>' as the register's value.  With targets that
GDB has no knowledge of the register saving convention, if a register
was not saved by the callee, then its value and location in the outer
frame are assumed to be the same of the inner frame.  This is usually
harmless, because if the register is call-clobbered, the caller either
does not care what is in the register after the call, or has code to
restore the value that it does care about.  Note, however, that if you
change such a register in the outer frame, you may also be affecting the
inner frame.  Also, the more "outer" the frame is you're looking at, the
more likely a call-clobbered register's value is to be wrong, in the
sense that it doesn't actually represent the value the register had just
before the call.

   ---------- Footnotes ----------

   (1) This is a way of removing one word from the stack, on machines
where stacks grow downward in memory (most machines, nowadays).  This
assumes that the innermost stack frame is selected; setting '$sp' is not
allowed when other stack frames are selected.  To pop entire frames off
the stack, regardless of machine architecture, use 'return'; see
Returning from a Function.

10.15 Floating Point Hardware
=============================

Depending on the configuration, GDB may be able to give you more
information about the status of the floating point hardware.

'info float'
     Display hardware-dependent information about the floating point
     unit.  The exact contents and layout vary depending on the floating
     point chip.  Currently, 'info float' is supported on the ARM and
     x86 machines.

10.16 Vector Unit
=================

Depending on the configuration, GDB may be able to give you more
information about the status of the vector unit.

'info vector'
     Display information about the vector unit.  The exact contents and
     layout vary depending on the hardware.

10.17 Operating System Auxiliary Information
============================================

GDB provides interfaces to useful OS facilities that can help you debug
your program.

   Some operating systems supply an "auxiliary vector" to programs at
startup.  This is akin to the arguments and environment that you specify
for a program, but contains a system-dependent variety of binary values
that tell system libraries important details about the hardware,
operating system, and process.  Each value's purpose is identified by an
integer tag; the meanings are well-known but system-specific.  Depending
on the configuration and operating system facilities, GDB may be able to
show you this information.  For remote targets, this functionality may
further depend on the remote stub's support of the 'qXfer:auxv:read'
packet, see qXfer auxiliary vector read.

'info auxv'
     Display the auxiliary vector of the inferior, which can be either a
     live process or a core dump file.  GDB prints each tag value
     numerically, and also shows names and text descriptions for
     recognized tags.  Some values in the vector are numbers, some bit
     masks, and some pointers to strings or other data.  GDB displays
     each value in the most appropriate form for a recognized tag, and
     in hexadecimal for an unrecognized tag.

   On some targets, GDB can access operating system-specific information
and show it to you.  The types of information available will differ
depending on the type of operating system running on the target.  The
mechanism used to fetch the data is described in Operating System Information.
For remote targets, this functionality depends on the
remote stub's support of the 'qXfer:osdata:read' packet, see qXfer osdata read.

'info os INFOTYPE'

     Display OS information of the requested type.

     On GNU/Linux, the following values of INFOTYPE are valid:

     'cpus'
          Display the list of all CPUs/cores.  For each CPU/core, GDB
          prints the available fields from /proc/cpuinfo.  For each
          supported architecture different fields are available.  Two
          common entries are processor which gives CPU number and
          bogomips; a system constant that is calculated during kernel
          initialization.

     'files'
          Display the list of open file descriptors on the target.  For
          each file descriptor, GDB prints the identifier of the process
          owning the descriptor, the command of the owning process, the
          value of the descriptor, and the target of the descriptor.

     'modules'
          Display the list of all loaded kernel modules on the target.
          For each module, GDB prints the module name, the size of the
          module in bytes, the number of times the module is used, the
          dependencies of the module, the status of the module, and the
          address of the loaded module in memory.

     'msg'
          Display the list of all System V message queues on the target.
          For each message queue, GDB prints the message queue key, the
          message queue identifier, the access permissions, the current
          number of bytes on the queue, the current number of messages
          on the queue, the processes that last sent and received a
          message on the queue, the user and group of the owner and
          creator of the message queue, the times at which a message was
          last sent and received on the queue, and the time at which the
          message queue was last changed.

     'processes'
          Display the list of processes on the target.  For each
          process, GDB prints the process identifier, the name of the
          user, the command corresponding to the process, and the list
          of processor cores that the process is currently running on.
          (To understand what these properties mean, for this and the
          following info types, please consult the general GNU/Linux
          documentation.)

     'procgroups'
          Display the list of process groups on the target.  For each
          process, GDB prints the identifier of the process group that
          it belongs to, the command corresponding to the process group
          leader, the process identifier, and the command line of the
          process.  The list is sorted first by the process group
          identifier, then by the process identifier, so that processes
          belonging to the same process group are grouped together and
          the process group leader is listed first.

     'semaphores'
          Display the list of all System V semaphore sets on the target.
          For each semaphore set, GDB prints the semaphore set key, the
          semaphore set identifier, the access permissions, the number
          of semaphores in the set, the user and group of the owner and
          creator of the semaphore set, and the times at which the
          semaphore set was operated upon and changed.

     'shm'
          Display the list of all System V shared-memory regions on the
          target.  For each shared-memory region, GDB prints the region
          key, the shared-memory identifier, the access permissions, the
          size of the region, the process that created the region, the
          process that last attached to or detached from the region, the
          current number of live attaches to the region, and the times
          at which the region was last attached to, detach from, and
          changed.

     'sockets'
          Display the list of Internet-domain sockets on the target.
          For each socket, GDB prints the address and port of the local
          and remote endpoints, the current state of the connection, the
          creator of the socket, the IP address family of the socket,
          and the type of the connection.

     'threads'
          Display the list of threads running on the target.  For each
          thread, GDB prints the identifier of the process that the
          thread belongs to, the command of the process, the thread
          identifier, and the processor core that it is currently
          running on.  The main thread of a process is not listed.

'info os'
     If INFOTYPE is omitted, then list the possible values for INFOTYPE
     and the kind of OS information available for each INFOTYPE.  If the
     target does not return a list of possible types, this command will
     report an error.

10.18 Memory Region Attributes
==============================

"Memory region attributes" allow you to describe special handling
required by regions of your target's memory.  GDB uses attributes to
determine whether to allow certain types of memory accesses; whether to
use specific width accesses; and whether to cache target memory.  By
default the description of memory regions is fetched from the target (if
the current target supports this), but the user can override the fetched
regions.

   Defined memory regions can be individually enabled and disabled.
When a memory region is disabled, GDB uses the default attributes when
accessing memory in that region.  Similarly, if no memory regions have
been defined, GDB uses the default attributes when accessing all memory.

   When a memory region is defined, it is given a number to identify it;
to enable, disable, or remove a memory region, you specify that number.

'mem LOWER UPPER ATTRIBUTES...'
     Define a memory region bounded by LOWER and UPPER with attributes
     ATTRIBUTES..., and add it to the list of regions monitored by GDB.
     Note that UPPER == 0 is a special case: it is treated as the
     target's maximum memory address.  (0xffff on 16 bit targets,
     0xffffffff on 32 bit targets, etc.)

'mem auto'
     Discard any user changes to the memory regions and use
     target-supplied regions, if available, or no regions if the target
     does not support.

'delete mem NUMS...'
     Remove memory regions NUMS... from the list of regions monitored by
     GDB.

'disable mem NUMS...'
     Disable monitoring of memory regions NUMS....  A disabled memory
     region is not forgotten.  It may be enabled again later.

'enable mem NUMS...'
     Enable monitoring of memory regions NUMS....

'info mem'
     Print a table of all defined memory regions, with the following
     columns for each region:

     _Memory Region Number_
     _Enabled or Disabled._
          Enabled memory regions are marked with 'y'.  Disabled memory
          regions are marked with 'n'.

     _Lo Address_
          The address defining the inclusive lower bound of the memory
          region.

     _Hi Address_
          The address defining the exclusive upper bound of the memory
          region.

     _Attributes_
          The list of attributes set for this memory region.

10.18.1 Attributes
------------------

10.18.1.1 Memory Access Mode
............................

The access mode attributes set whether GDB may make read or write
accesses to a memory region.

   While these attributes prevent GDB from performing invalid memory
accesses, they do nothing to prevent the target system, I/O DMA, etc.
from accessing memory.

'ro'
     Memory is read only.
'wo'
     Memory is write only.
'rw'
     Memory is read/write.  This is the default.

10.18.1.2 Memory Access Size
............................

The access size attribute tells GDB to use specific sized accesses in
the memory region.  Often memory mapped device registers require
specific sized accesses.  If no access size attribute is specified, GDB
may use accesses of any size.

'8'
     Use 8 bit memory accesses.
'16'
     Use 16 bit memory accesses.
'32'
     Use 32 bit memory accesses.
'64'
     Use 64 bit memory accesses.

10.18.1.3 Data Cache
....................

The data cache attributes set whether GDB will cache target memory.
While this generally improves performance by reducing debug protocol
overhead, it can lead to incorrect results because GDB does not know
about volatile variables or memory mapped device registers.

'cache'
     Enable GDB to cache target memory.
'nocache'
     Disable GDB from caching target memory.  This is the default.

10.18.2 Memory Access Checking
------------------------------

GDB can be instructed to refuse accesses to memory that is not
explicitly described.  This can be useful if accessing such regions has
undesired effects for a specific target, or to provide better error
checking.  The following commands control this behavior.

'set mem inaccessible-by-default [on|off]'
     If 'on' is specified, make GDB treat memory not explicitly
     described by the memory ranges as non-existent and refuse accesses
     to such memory.  The checks are only performed if there's at least
     one memory range defined.  If 'off' is specified, make GDB treat
     the memory not explicitly described by the memory ranges as RAM.
     The default value is 'on'.
'show mem inaccessible-by-default'
     Show the current handling of accesses to unknown memory.

10.19 Copy Between Memory and a File
====================================

You can use the commands 'dump', 'append', and 'restore' to copy data
between target memory and a file.  The 'dump' and 'append' commands
write data to a file, and the 'restore' command reads data from a file
back into the inferior's memory.  Files may be in binary, Motorola
S-record, Intel hex, Tektronix Hex, or Verilog Hex format; however, GDB
can only append to binary files, and cannot read from Verilog Hex files.

'dump [FORMAT] memory FILENAME START_ADDR END_ADDR'
'dump [FORMAT] value FILENAME EXPR'
     Dump the contents of memory from START_ADDR to END_ADDR, or the
     value of EXPR, to FILENAME in the given format.

     The FORMAT parameter may be any one of:
     'binary'
          Raw binary form.
     'ihex'
          Intel hex format.
     'srec'
          Motorola S-record format.
     'tekhex'
          Tektronix Hex format.
     'verilog'
          Verilog Hex format.

     GDB uses the same definitions of these formats as the GNU binary
     utilities, like 'objdump' and 'objcopy'.  If FORMAT is omitted, GDB
     dumps the data in raw binary form.

'append [binary] memory FILENAME START_ADDR END_ADDR'
'append [binary] value FILENAME EXPR'
     Append the contents of memory from START_ADDR to END_ADDR, or the
     value of EXPR, to the file FILENAME, in raw binary form.  (GDB can
     only append data to files in raw binary form.)

'restore FILENAME [binary] BIAS START END'
     Restore the contents of file FILENAME into memory.  The 'restore'
     command can automatically recognize any known BFD file format,
     except for raw binary.  To restore a raw binary file you must
     specify the optional keyword 'binary' after the filename.

     If BIAS is non-zero, its value will be added to the addresses
     contained in the file.  Binary files always start at address zero,
     so they will be restored at address BIAS.  Other bfd files have a
     built-in location; they will be restored at offset BIAS from that
     location.

     If START and/or END are non-zero, then only data between file
     offset START and file offset END will be restored.  These offsets
     are relative to the addresses in the file, before the BIAS argument
     is applied.

10.20 How to Produce a Core File from Your Program
==================================================

A "core file" or "core dump" is a file that records the memory image of
a running process and its process status (register values etc.).  Its
primary use is post-mortem debugging of a program that crashed while it
ran outside a debugger.  A program that crashes automatically produces a
core file, unless this feature is disabled by the user.  See Files,
for information on invoking GDB in the post-mortem debugging mode.

   Occasionally, you may wish to produce a core file of the program you
are debugging in order to preserve a snapshot of its state.  GDB has a
special command for that.

'generate-core-file [FILE]'
'gcore [FILE]'
     Produce a core dump of the inferior process.  The optional argument
     FILE specifies the file name where to put the core dump.  If not
     specified, the file name defaults to 'core.PID', where PID is the
     inferior process ID.

     If supported by the filesystem where the core is written to, GDB
     generates a sparse core dump file.

     Note that this command is implemented only for some systems (as of
     this writing, GNU/Linux, FreeBSD, Solaris, and S390).

     On GNU/Linux, this command can take into account the value of the
     file '/proc/PID/coredump_filter' when generating the core dump
     (see set use-coredump-filter), and by default honors the
     'VM_DONTDUMP' flag for mappings where it is present in the file
     '/proc/PID/smaps' (see set dump-excluded-mappings).

'set use-coredump-filter on'
'set use-coredump-filter off'
     Enable or disable the use of the file '/proc/PID/coredump_filter'
     when generating core dump files.  This file is used by the Linux
     kernel to decide what types of memory mappings will be dumped or
     ignored when generating a core dump file.  PID is the process ID of
     a currently running process.

     To make use of this feature, you have to write in the
     '/proc/PID/coredump_filter' file a value, in hexadecimal, which is
     a bit mask representing the memory mapping types.  If a bit is set
     in the bit mask, then the memory mappings of the corresponding
     types will be dumped; otherwise, they will be ignored.  This
     configuration is inherited by child processes.  For more
     information about the bits that can be set in the
     '/proc/PID/coredump_filter' file, please refer to the manpage of
     'core(5)'.

     By default, this option is 'on'.  If this option is turned 'off',
     GDB does not read the 'coredump_filter' file and instead uses the
     same default value as the Linux kernel in order to decide which
     pages will be dumped in the core dump file.  This value is
     currently '0x33', which means that bits '0' (anonymous private
     mappings), '1' (anonymous shared mappings), '4' (ELF headers) and
     '5' (private huge pages) are active.  This will cause these memory
     mappings to be dumped automatically.

'set dump-excluded-mappings on'
'set dump-excluded-mappings off'
     If 'on' is specified, GDB will dump memory mappings marked with the
     'VM_DONTDUMP' flag.  This flag is represented in the file
     '/proc/PID/smaps' with the acronym 'dd'.

     The default value is 'off'.

10.21 Character Sets
====================

If the program you are debugging uses a different character set to
represent characters and strings than the one GDB uses itself, GDB can
automatically translate between the character sets for you.  The
character set GDB uses we call the "host character set"; the one the
inferior program uses we call the "target character set".

   For example, if you are running GDB on a GNU/Linux system, which uses
the ISO Latin 1 character set, but you are using GDB's remote protocol
(see Remote Debugging) to debug a program running on an IBM
mainframe, which uses the EBCDIC character set, then the host character
set is Latin-1, and the target character set is EBCDIC.  If you give GDB
the command 'set target-charset EBCDIC-US', then GDB translates between
EBCDIC and Latin 1 as you print character or string values, or use
character and string literals in expressions.

   GDB has no way to automatically recognize which character set the
inferior program uses; you must tell it, using the 'set target-charset'
command, described below.

   Here are the commands for controlling GDB's character set support:

'set target-charset CHARSET'
     Set the current target character set to CHARSET.  To display the
     list of supported target character sets, type
     'set target-charset <TAB><TAB>'.

'set host-charset CHARSET'
     Set the current host character set to CHARSET.

     By default, GDB uses a host character set appropriate to the system
     it is running on; you can override that default using the 'set
     host-charset' command.  On some systems, GDB cannot automatically
     determine the appropriate host character set.  In this case, GDB
     uses 'UTF-8'.

     GDB can only use certain character sets as its host character set.
     If you type 'set host-charset <TAB><TAB>', GDB will list the host
     character sets it supports.

'set charset CHARSET'
     Set the current host and target character sets to CHARSET.  As
     above, if you type 'set charset <TAB><TAB>', GDB will list the
     names of the character sets that can be used for both host and
     target.

'show charset'
     Show the names of the current host and target character sets.

'show host-charset'
     Show the name of the current host character set.

'show target-charset'
     Show the name of the current target character set.

'set target-wide-charset CHARSET'
     Set the current target's wide character set to CHARSET.  This is
     the character set used by the target's 'wchar_t' type.  To display
     the list of supported wide character sets, type
     'set target-wide-charset <TAB><TAB>'.

'show target-wide-charset'
     Show the name of the current target's wide character set.

   Here is an example of GDB's character set support in action.  Assume
that the following source code has been placed in the file
'charset-test.c':

     #include <stdio.h>

     char ascii_hello[]
       = {72, 101, 108, 108, 111, 44, 32, 119,
          111, 114, 108, 100, 33, 10, 0};
     char ibm1047_hello[]
       = {200, 133, 147, 147, 150, 107, 64, 166,
          150, 153, 147, 132, 90, 37, 0};

     main ()
     {
       printf ("Hello, world!\n");
     }

   In this program, 'ascii_hello' and 'ibm1047_hello' are arrays
containing the string 'Hello, world!' followed by a newline, encoded in
the ASCII and IBM1047 character sets.

   We compile the program, and invoke the debugger on it:

     $ gcc -g charset-test.c -o charset-test
     $ gdb -nw charset-test
     GNU gdb 2001-12-19-cvs
     Copyright 2001 Free Software Foundation, Inc.
     ...
     (gdb)

   We can use the 'show charset' command to see what character sets GDB
is currently using to interpret and display characters and strings:

     (gdb) show charset
     The current host and target character set is `ISO-8859-1'.
     (gdb)

   For the sake of printing this manual, let's use ASCII as our initial
character set:
     (gdb) set charset ASCII
     (gdb) show charset
     The current host and target character set is `ASCII'.
     (gdb)

   Let's assume that ASCII is indeed the correct character set for our
host system -- in other words, let's assume that if GDB prints
characters using the ASCII character set, our terminal will display them
properly.  Since our current target character set is also ASCII, the
contents of 'ascii_hello' print legibly:

     (gdb) print ascii_hello
     $1 = 0x401698 "Hello, world!\n"
     (gdb) print ascii_hello[0]
     $2 = 72 'H'
     (gdb)

   GDB uses the target character set for character and string literals
you use in expressions:

     (gdb) print '+'
     $3 = 43 '+'
     (gdb)

   The ASCII character set uses the number 43 to encode the '+'
character.

   GDB relies on the user to tell it which character set the target
program uses.  If we print 'ibm1047_hello' while our target character
set is still ASCII, we get jibberish:

     (gdb) print ibm1047_hello
     $4 = 0x4016a8 "\310\205\223\223\226k@\246\226\231\223\204Z%"
     (gdb) print ibm1047_hello[0]
     $5 = 200 '\310'
     (gdb)

   If we invoke the 'set target-charset' followed by <TAB><TAB>, GDB
tells us the character sets it supports:

     (gdb) set target-charset
     ASCII       EBCDIC-US   IBM1047     ISO-8859-1
     (gdb) set target-charset

   We can select IBM1047 as our target character set, and examine the
program's strings again.  Now the ASCII string is wrong, but GDB
translates the contents of 'ibm1047_hello' from the target character
set, IBM1047, to the host character set, ASCII, and they display
correctly:

     (gdb) set target-charset IBM1047
     (gdb) show charset
     The current host character set is `ASCII'.
     The current target character set is `IBM1047'.
     (gdb) print ascii_hello
     $6 = 0x401698 "\110\145%%?\054\040\167?\162%\144\041\012"
     (gdb) print ascii_hello[0]
     $7 = 72 '\110'
     (gdb) print ibm1047_hello
     $8 = 0x4016a8 "Hello, world!\n"
     (gdb) print ibm1047_hello[0]
     $9 = 200 'H'
     (gdb)

   As above, GDB uses the target character set for character and string
literals you use in expressions:

     (gdb) print '+'
     $10 = 78 '+'
     (gdb)

   The IBM1047 character set uses the number 78 to encode the '+'
character.

10.22 Caching Data of Targets
=============================

GDB caches data exchanged between the debugger and a target.  Each cache
is associated with the address space of the inferior.  See Inferiors Connections and Programs,
about inferior and address space.  Such
caching generally improves performance in remote debugging (see Remote Debugging),
because it reduces the overhead of the remote protocol by
bundling memory reads and writes into large chunks.  Unfortunately,
simply caching everything would lead to incorrect results, since GDB
does not necessarily know anything about volatile values, memory-mapped
I/O addresses, etc.  Furthermore, in non-stop mode (see Non-Stop Mode)
memory can be changed _while_ a gdb command is executing.
Therefore, by default, GDB only caches data known to be on the stack(1)
or in the code segment.  Other regions of memory can be explicitly
marked as cacheable; see Memory Region Attributes.

'set remotecache on'
'set remotecache off'
     This option no longer does anything; it exists for compatibility
     with old scripts.

'show remotecache'
     Show the current state of the obsolete remotecache flag.

'set stack-cache on'
'set stack-cache off'
     Enable or disable caching of stack accesses.  When 'on', use
     caching.  By default, this option is 'on'.

'show stack-cache'
     Show the current state of data caching for memory accesses.

'set code-cache on'
'set code-cache off'
     Enable or disable caching of code segment accesses.  When 'on', use
     caching.  By default, this option is 'on'.  This improves
     performance of disassembly in remote debugging.

'show code-cache'
     Show the current state of target memory cache for code segment
     accesses.

'info dcache [line]'
     Print the information about the performance of data cache of the
     current inferior's address space.  The information displayed
     includes the dcache width and depth, and for each cache line, its
     number, address, and how many times it was referenced.  This
     command is useful for debugging the data cache operation.

     If a line number is specified, the contents of that line will be
     printed in hex.

'set dcache size SIZE'
     Set maximum number of entries in dcache (dcache depth above).

'set dcache line-size LINE-SIZE'
     Set number of bytes each dcache entry caches (dcache width above).
     Must be a power of 2.

'show dcache size'
     Show maximum number of dcache entries.  See info dcache.

'show dcache line-size'
     Show default size of dcache lines.

'maint flush dcache'
     Flush the contents (if any) of the dcache.  This maintainer command
     is useful when debugging the dcache implementation.

   ---------- Footnotes ----------

   (1) In non-stop mode, it is moderately rare for a running thread to
modify the stack of a stopped thread in a way that would interfere with
a backtrace, and caching of stack reads provides a significant speed up
of remote backtraces.

10.23 Search Memory
===================

Memory can be searched for a particular sequence of bytes with the
'find' command.

'find [/SN] START_ADDR, +LEN, VAL1 [, VAL2, ...]'
'find [/SN] START_ADDR, END_ADDR, VAL1 [, VAL2, ...]'
     Search memory for the sequence of bytes specified by VAL1, VAL2,
     etc.  The search begins at address START_ADDR and continues for
     either LEN bytes or through to END_ADDR inclusive.

   S and N are optional parameters.  They may be specified in either
order, apart or together.

S, search query size
     The size of each search query value.

     'b'
          bytes
     'h'
          halfwords (two bytes)
     'w'
          words (four bytes)
     'g'
          giant words (eight bytes)

     All values are interpreted in the current language.  This means,
     for example, that if the current source language is C/C++ then
     searching for the string "hello" includes the trailing '\0'.  The
     null terminator can be removed from searching by using casts, e.g.:
     '{char[5]}"hello"'.

     If the value size is not specified, it is taken from the value's
     type in the current language.  This is useful when one wants to
     specify the search pattern as a mixture of types.  Note that this
     means, for example, that in the case of C-like languages a search
     for an untyped 0x42 will search for '(int) 0x42' which is typically
     four bytes.

N, maximum number of finds
     The maximum number of matches to print.  The default is to print
     all finds.

   You can use strings as search values.  Quote them with double-quotes
('"').  The string value is copied into the search pattern byte by byte,
regardless of the endianness of the target and the size specification.

   The address of each match found is printed as well as a count of the
number of matches found.

   The address of the last value found is stored in convenience variable
'$_'.  A count of the number of matches is stored in '$numfound'.

   For example, if stopped at the 'printf' in this function:

     void
     hello ()
     {
       static char hello[] = "hello-hello";
       static struct { char c; short s; int i; }
         __attribute__ ((packed)) mixed
         = { 'c', 0x1234, 0x87654321 };
       printf ("%s\n", hello);
     }

you get during debugging:

     (gdb) find &hello[0], +sizeof(hello), "hello"
     0x804956d <hello.1620+6>
     1 pattern found
     (gdb) find &hello[0], +sizeof(hello), 'h', 'e', 'l', 'l', 'o'
     0x8049567 <hello.1620>
     0x804956d <hello.1620+6>
     2 patterns found.
     (gdb) find &hello[0], +sizeof(hello), {char[5]}"hello"
     0x8049567 <hello.1620>
     0x804956d <hello.1620+6>
     2 patterns found.
     (gdb) find /b1 &hello[0], +sizeof(hello), 'h', 0x65, 'l'
     0x8049567 <hello.1620>
     1 pattern found
     (gdb) find &mixed, +sizeof(mixed), (char) 'c', (short) 0x1234, (int) 0x87654321
     0x8049560 <mixed.1625>
     1 pattern found
     (gdb) print $numfound
     $1 = 1
     (gdb) print $_
     $2 = (void *) 0x8049560

10.24 Value Sizes
=================

Whenever GDB prints a value memory will be allocated within GDB to hold
the contents of the value.  It is possible in some languages with
dynamic typing systems, that an invalid program may indicate a value
that is incorrectly large, this in turn may cause GDB to try and
allocate an overly large amount of memory.

'set max-value-size BYTES'
'set max-value-size unlimited'
     Set the maximum size of memory that GDB will allocate for the
     contents of a value to BYTES, trying to display a value that
     requires more memory than that will result in an error.

     Setting this variable does not effect values that have already been
     allocated within GDB, only future allocations.

     There's a minimum size that 'max-value-size' can be set to in order
     that GDB can still operate correctly, this minimum is currently 16
     bytes.

     The limit applies to the results of some subexpressions as well as
     to complete expressions.  For example, an expression denoting a
     simple integer component, such as 'x.y.z', may fail if the size of
     X.Y is dynamic and exceeds BYTES.  On the other hand, GDB is
     sometimes clever; the expression 'A[i]', where A is an array
     variable with non-constant size, will generally succeed regardless
     of the bounds on A, as long as the component size is less than
     BYTES.

     The default value of 'max-value-size' is currently 64k.

'show max-value-size'
     Show the maximum size of memory, in bytes, that GDB will allocate
     for the contents of a value.

11 Debugging Optimized Code
***************************

Almost all compilers support optimization.  With optimization disabled,
the compiler generates assembly code that corresponds directly to your
source code, in a simplistic way.  As the compiler applies more powerful
optimizations, the generated assembly code diverges from your original
source code.  With help from debugging information generated by the
compiler, GDB can map from the running program back to constructs from
your original source.

   GDB is more accurate with optimization disabled.  If you can
recompile without optimization, it is easier to follow the progress of
your program during debugging.  But, there are many cases where you may
need to debug an optimized version.

   When you debug a program compiled with '-g -O', remember that the
optimizer has rearranged your code; the debugger shows you what is
really there.  Do not be too surprised when the execution path does not
exactly match your source file!  An extreme example: if you define a
variable, but never use it, GDB never sees that variable--because the
compiler optimizes it out of existence.

   Some things do not work as well with '-g -O' as with just '-g',
particularly on machines with instruction scheduling.  If in doubt,
recompile with '-g' alone, and if this fixes the problem, please report
it to us as a bug (including a test case!).  See Variables, for more
information about debugging optimized code.

11.1 Inline Functions
=====================

"Inlining" is an optimization that inserts a copy of the function body
directly at each call site, instead of jumping to a shared routine.  GDB
displays inlined functions just like non-inlined functions.  They appear
in backtraces.  You can view their arguments and local variables, step
into them with 'step', skip them with 'next', and escape from them with
'finish'.  You can check whether a function was inlined by using the
'info frame' command.

   For GDB to support inlined functions, the compiler must record
information about inlining in the debug information -- GCC using the
DWARF 2 format does this, and several other compilers do also.  GDB only
supports inlined functions when using DWARF 2.  Versions of GCC before
4.1 do not emit two required attributes ('DW_AT_call_file' and
'DW_AT_call_line'); GDB does not display inlined function calls with
earlier versions of GCC.  It instead displays the arguments and local
variables of inlined functions as local variables in the caller.

   The body of an inlined function is directly included at its call
site; unlike a non-inlined function, there are no instructions devoted
to the call.  GDB still pretends that the call site and the start of the
inlined function are different instructions.  Stepping to the call site
shows the call site, and then stepping again shows the first line of the
inlined function, even though no additional instructions are executed.

   This makes source-level debugging much clearer; you can see both the
context of the call and then the effect of the call.  Only stepping by a
single instruction using 'stepi' or 'nexti' does not do this; single
instruction steps always show the inlined body.

   There are some ways that GDB does not pretend that inlined function
calls are the same as normal calls:

   * Setting breakpoints at the call site of an inlined function may not
     work, because the call site does not contain any code.  GDB may
     incorrectly move the breakpoint to the next line of the enclosing
     function, after the call.  This limitation will be removed in a
     future version of GDB; until then, set a breakpoint on an earlier
     line or inside the inlined function instead.

   * GDB cannot locate the return value of inlined calls after using the
     'finish' command.  This is a limitation of compiler-generated
     debugging information; after 'finish', you can step to the next
     line and print a variable where your program stored the return
     value.

11.2 Tail Call Frames
=====================

Function 'B' can call function 'C' in its very last statement.  In
unoptimized compilation the call of 'C' is immediately followed by
return instruction at the end of 'B' code.  Optimizing compiler may
replace the call and return in function 'B' into one jump to function
'C' instead.  Such use of a jump instruction is called "tail call".

   During execution of function 'C', there will be no indication in the
function call stack frames that it was tail-called from 'B'.  If
function 'A' regularly calls function 'B' which tail-calls function 'C',
then GDB will see 'A' as the caller of 'C'.  However, in some cases GDB
can determine that 'C' was tail-called from 'B', and it will then create
fictitious call frame for that, with the return address set up as if 'B'
called 'C' normally.

   This functionality is currently supported only by DWARF 2 debugging
format and the compiler has to produce 'DW_TAG_call_site' tags.  With
GCC, you need to specify '-O -g' during compilation, to get this
information.

   'info frame' command (see Frame Info) will indicate the tail call
frame kind by text 'tail call frame' such as in this sample GDB output:

     (gdb) x/i $pc - 2
        0x40066b <b(int, double)+11>: jmp 0x400640 <c(int, double)>
     (gdb) info frame
     Stack level 1, frame at 0x7fffffffda30:
      rip = 0x40066d in b (amd64-entry-value.cc:59); saved rip 0x4004c5
      tail call frame, caller of frame at 0x7fffffffda30
      source language c++.
      Arglist at unknown address.
      Locals at unknown address, Previous frame's sp is 0x7fffffffda30

   The detection of all the possible code path executions can find them
ambiguous.  There is no execution history stored (possible Reverse Execution
is never used for this purpose) and the last known caller
could have reached the known callee by multiple different jump
sequences.  In such case GDB still tries to show at least all the
unambiguous top tail callers and all the unambiguous bottom tail
callees, if any.

'set debug entry-values'
     When set to on, enables printing of analysis messages for both
     frame argument values at function entry and tail calls.  It will
     show all the possible valid tail calls code paths it has
     considered.  It will also print the intersection of them with the
     final unambiguous (possibly partial or even empty) code path
     result.

'show debug entry-values'
     Show the current state of analysis messages printing for both frame
     argument values at function entry and tail calls.

   The analysis messages for tail calls can for example show why the
virtual tail call frame for function 'c' has not been recognized (due to
the indirect reference by variable 'x'):

     static void __attribute__((noinline, noclone)) c (void);
     void (*x) (void) = c;
     static void __attribute__((noinline, noclone)) a (void) { x++; }
     static void __attribute__((noinline, noclone)) c (void) { a (); }
     int main (void) { x (); return 0; }

     Breakpoint 1, DW_OP_entry_value resolving cannot find
     DW_TAG_call_site 0x40039a in main
     a () at t.c:3
     3	static void __attribute__((noinline, noclone)) a (void) { x++; }
     (gdb) bt
     #0  a () at t.c:3
     #1  0x000000000040039a in main () at t.c:5

   Another possibility is an ambiguous virtual tail call frames
resolution:

     int i;
     static void __attribute__((noinline, noclone)) f (void) { i++; }
     static void __attribute__((noinline, noclone)) e (void) { f (); }
     static void __attribute__((noinline, noclone)) d (void) { f (); }
     static void __attribute__((noinline, noclone)) c (void) { d (); }
     static void __attribute__((noinline, noclone)) b (void)
     { if (i) c (); else e (); }
     static void __attribute__((noinline, noclone)) a (void) { b (); }
     int main (void) { a (); return 0; }

     tailcall: initial: 0x4004d2(a) 0x4004ce(b) 0x4004b2(c) 0x4004a2(d)
     tailcall: compare: 0x4004d2(a) 0x4004cc(b) 0x400492(e)
     tailcall: reduced: 0x4004d2(a) |
     (gdb) bt
     #0  f () at t.c:2
     #1  0x00000000004004d2 in a () at t.c:8
     #2  0x0000000000400395 in main () at t.c:9

   Frames #0 and #2 are real, #1 is a virtual tail call frame.  The code
can have possible execution paths 'main->a->b->c->d->f' or
'main->a->b->e->f', GDB cannot find which one from the inferior state.

   'initial:' state shows some random possible calling sequence GDB has
found.  It then finds another possible calling sequence - that one is
prefixed by 'compare:'.  The non-ambiguous intersection of these two is
printed as the 'reduced:' calling sequence.  That one could have many
further 'compare:' and 'reduced:' statements as long as there remain any
non-ambiguous sequence entries.

   For the frame of function 'b' in both cases there are different
possible '$pc' values ('0x4004cc' or '0x4004ce'), therefore this frame
is also ambiguous.  The only non-ambiguous frame is the one for function
'a', therefore this one is displayed to the user while the ambiguous
frames are omitted.

   There can be also reasons why printing of frame argument values at
function entry may fail:

     int v;
     static void __attribute__((noinline, noclone)) c (int i) { v++; }
     static void __attribute__((noinline, noclone)) a (int i);
     static void __attribute__((noinline, noclone)) b (int i) { a (i); }
     static void __attribute__((noinline, noclone)) a (int i)
     { if (i) b (i - 1); else c (0); }
     int main (void) { a (5); return 0; }

     (gdb) bt
     #0  c (i=i@entry=0) at t.c:2
     #1  0x0000000000400428 in a (DW_OP_entry_value resolving has found
     function "a" at 0x400420 can call itself via tail calls
     i=<optimized out>) at t.c:6
     #2  0x000000000040036e in main () at t.c:7

   GDB cannot find out from the inferior state if and how many times did
function 'a' call itself (via function 'b') as these calls would be tail
calls.  Such tail calls would modify the 'i' variable, therefore GDB
cannot be sure the value it knows would be right - GDB prints
'<optimized out>' instead.

12 C Preprocessor Macros
************************

Some languages, such as C and C++, provide a way to define and invoke
"preprocessor macros" which expand into strings of tokens.  GDB can
evaluate expressions containing macro invocations, show the result of
macro expansion, and show a macro's definition, including where it was
defined.

   You may need to compile your program specially to provide GDB with
information about preprocessor macros.  Most compilers do not include
macros in their debugging information, even when you compile with the
'-g' flag.  See Compilation.

   A program may define a macro at one point, remove that definition
later, and then provide a different definition after that.  Thus, at
different points in the program, a macro may have different definitions,
or have no definition at all.  If there is a current stack frame, GDB
uses the macros in scope at that frame's source code line.  Otherwise,
GDB uses the macros in scope at the current listing location; see
List.

   Whenever GDB evaluates an expression, it always expands any macro
invocations present in the expression.  GDB also provides the following
commands for working with macros explicitly.

'macro expand EXPRESSION'
'macro exp EXPRESSION'
     Show the results of expanding all preprocessor macro invocations in
     EXPRESSION.  Since GDB simply expands macros, but does not parse
     the result, EXPRESSION need not be a valid expression; it can be
     any string of tokens.

'macro expand-once EXPRESSION'
'macro exp1 EXPRESSION'
     (This command is not yet implemented.)  Show the results of
     expanding those preprocessor macro invocations that appear
     explicitly in EXPRESSION.  Macro invocations appearing in that
     expansion are left unchanged.  This command allows you to see the
     effect of a particular macro more clearly, without being confused
     by further expansions.  Since GDB simply expands macros, but does
     not parse the result, EXPRESSION need not be a valid expression; it
     can be any string of tokens.

'info macro [-a|-all] [--] MACRO'
     Show the current definition or all definitions of the named MACRO,
     and describe the source location or compiler command-line where
     that definition was established.  The optional double dash is to
     signify the end of argument processing and the beginning of MACRO
     for non C-like macros where the macro may begin with a hyphen.

'info macros LOCSPEC'
     Show all macro definitions that are in effect at the source line of
     the code location that results from resolving LOCSPEC, and describe
     the source location or compiler command-line where those
     definitions were established.

'macro define MACRO REPLACEMENT-LIST'
'macro define MACRO(ARGLIST) REPLACEMENT-LIST'
     Introduce a definition for a preprocessor macro named MACRO,
     invocations of which are replaced by the tokens given in
     REPLACEMENT-LIST.  The first form of this command defines an
     "object-like" macro, which takes no arguments; the second form
     defines a "function-like" macro, which takes the arguments given in
     ARGLIST.

     A definition introduced by this command is in scope in every
     expression evaluated in GDB, until it is removed with the 'macro
     undef' command, described below.  The definition overrides all
     definitions for MACRO present in the program being debugged, as
     well as any previous user-supplied definition.

'macro undef MACRO'
     Remove any user-supplied definition for the macro named MACRO.
     This command only affects definitions provided with the 'macro
     define' command, described above; it cannot remove definitions
     present in the program being debugged.

'macro list'
     List all the macros defined using the 'macro define' command.

   Here is a transcript showing the above commands in action.  First, we
show our source files:

     $ cat sample.c
     #include <stdio.h>
     #include "sample.h"

     #define M 42
     #define ADD(x) (M + x)

     main ()
     {
     #define N 28
       printf ("Hello, world!\n");
     #undef N
       printf ("We're so creative.\n");
     #define N 1729
       printf ("Goodbye, world!\n");
     }
     $ cat sample.h
     #define Q <
     $

   Now, we compile the program using the GNU C compiler, GCC.  We pass
the '-gdwarf-2'(1) _and_ '-g3' flags to ensure the compiler includes
information about preprocessor macros in the debugging information.

     $ gcc -gdwarf-2 -g3 sample.c -o sample
     $

   Now, we start GDB on our sample program:

     $ gdb -nw sample
     GNU gdb 2002-05-06-cvs
     Copyright 2002 Free Software Foundation, Inc.
     GDB is free software, ...
     (gdb)

   We can expand macros and examine their definitions, even when the
program is not running.  GDB uses the current listing position to decide
which macro definitions are in scope:

     (gdb) list main
     3
     4       #define M 42
     5       #define ADD(x) (M + x)
     6
     7       main ()
     8       {
     9       #define N 28
     10        printf ("Hello, world!\n");
     11      #undef N
     12        printf ("We're so creative.\n");
     (gdb) info macro ADD
     Defined at /home/jimb/gdb/macros/play/sample.c:5
     #define ADD(x) (M + x)
     (gdb) info macro Q
     Defined at /home/jimb/gdb/macros/play/sample.h:1
       included at /home/jimb/gdb/macros/play/sample.c:2
     #define Q <
     (gdb) macro expand ADD(1)
     expands to: (42 + 1)
     (gdb) macro expand-once ADD(1)
     expands to: once (M + 1)
     (gdb)

   In the example above, note that 'macro expand-once' expands only the
macro invocation explicit in the original text -- the invocation of
'ADD' -- but does not expand the invocation of the macro 'M', which was
introduced by 'ADD'.

   Once the program is running, GDB uses the macro definitions in force
at the source line of the current stack frame:

     (gdb) break main
     Breakpoint 1 at 0x8048370: file sample.c, line 10.
     (gdb) run
     Starting program: /home/jimb/gdb/macros/play/sample

     Breakpoint 1, main () at sample.c:10
     10        printf ("Hello, world!\n");
     (gdb)

   At line 10, the definition of the macro 'N' at line 9 is in force:

     (gdb) info macro N
     Defined at /home/jimb/gdb/macros/play/sample.c:9
     #define N 28
     (gdb) macro expand N Q M
     expands to: 28 < 42
     (gdb) print N Q M
     $1 = 1
     (gdb)

   As we step over directives that remove 'N''s definition, and then
give it a new definition, GDB finds the definition (or lack thereof) in
force at each point:

     (gdb) next
     Hello, world!
     12        printf ("We're so creative.\n");
     (gdb) info macro N
     The symbol `N' has no definition as a C/C++ preprocessor macro
     at /home/jimb/gdb/macros/play/sample.c:12
     (gdb) next
     We're so creative.
     14        printf ("Goodbye, world!\n");
     (gdb) info macro N
     Defined at /home/jimb/gdb/macros/play/sample.c:13
     #define N 1729
     (gdb) macro expand N Q M
     expands to: 1729 < 42
     (gdb) print N Q M
     $2 = 0
     (gdb)

   In addition to source files, macros can be defined on the compilation
command line using the '-DNAME=VALUE' syntax.  For macros defined in
such a way, GDB displays the location of their definition as line zero
of the source file submitted to the compiler.

     (gdb) info macro __STDC__
     Defined at /home/jimb/gdb/macros/play/sample.c:0
     -D__STDC__=1
     (gdb)

   ---------- Footnotes ----------

   (1) This is the minimum.  Recent versions of GCC support '-gdwarf-3'
and '-gdwarf-4'; we recommend always choosing the most recent version of
DWARF.

13 Tracepoints
**************

In some applications, it is not feasible for the debugger to interrupt
the program's execution long enough for the developer to learn anything
helpful about its behavior.  If the program's correctness depends on its
real-time behavior, delays introduced by a debugger might cause the
program to change its behavior drastically, or perhaps fail, even when
the code itself is correct.  It is useful to be able to observe the
program's behavior without interrupting it.

   Using GDB's 'trace' and 'collect' commands, you can specify locations
in the program, called "tracepoints", and arbitrary expressions to
evaluate when those tracepoints are reached.  Later, using the 'tfind'
command, you can examine the values those expressions had when the
program hit the tracepoints.  The expressions may also denote objects in
memory--structures or arrays, for example--whose values GDB should
record; while visiting a particular tracepoint, you may inspect those
objects as if they were in memory at that moment.  However, because GDB
records these values without interacting with you, it can do so quickly
and unobtrusively, hopefully not disturbing the program's behavior.

   The tracepoint facility is currently available only for remote
targets.  See Targets.  In addition, your remote target must know
how to collect trace data.  This functionality is implemented in the
remote stub; however, none of the stubs distributed with GDB support
tracepoints as of this writing.  The format of the remote packets used
to implement tracepoints are described in Tracepoint Packets.

   It is also possible to get trace data from a file, in a manner
reminiscent of corefiles; you specify the filename, and use 'tfind' to
search through the file.  See Trace Files, for more details.

   This chapter describes the tracepoint commands and features.

13.1 Commands to Set Tracepoints
================================

Before running such a "trace experiment", an arbitrary number of
tracepoints can be set.  A tracepoint is actually a special type of
breakpoint (see Set Breaks), so you can manipulate it using standard
breakpoint commands.  For instance, as with breakpoints, tracepoint
numbers are successive integers starting from one, and many of the
commands associated with tracepoints take the tracepoint number as their
argument, to identify which tracepoint to work on.

   For each tracepoint, you can specify, in advance, some arbitrary set
of data that you want the target to collect in the trace buffer when it
hits that tracepoint.  The collected data can include registers, local
variables, or global data.  Later, you can use GDB commands to examine
the values these data had at the time the tracepoint was hit.

   Tracepoints do not support every breakpoint feature.  Ignore counts
on tracepoints have no effect, and tracepoints cannot run GDB commands
when they are hit.  Tracepoints may not be thread-specific either.

   Some targets may support "fast tracepoints", which are inserted in a
different way (such as with a jump instead of a trap), that is faster
but possibly restricted in where they may be installed.

   Regular and fast tracepoints are dynamic tracing facilities, meaning
that they can be used to insert tracepoints at (almost) any location in
the target.  Some targets may also support controlling "static
tracepoints" from GDB.  With static tracing, a set of instrumentation
points, also known as "markers", are embedded in the target program, and
can be activated or deactivated by name or address.  These are usually
placed at locations which facilitate investigating what the target is
actually doing.  GDB's support for static tracing includes being able to
list instrumentation points, and attach them with GDB defined high level
tracepoints that expose the whole range of convenience of GDB's
tracepoints support.  Namely, support for collecting registers values
and values of global or local (to the instrumentation point) variables;
tracepoint conditions and trace state variables.  The act of installing
a GDB static tracepoint on an instrumentation point, or marker, is
referred to as "probing" a static tracepoint marker.

   'gdbserver' supports tracepoints on some target systems.  See
Tracepoints support in 'gdbserver'.

   This section describes commands to set tracepoints and associated
conditions and actions.

13.1.1 Create and Delete Tracepoints
------------------------------------

'trace LOCSPEC'
     The 'trace' command is very similar to the 'break' command.  Its
     argument LOCSPEC can be any valid location specification.  See
     Location Specifications.  The 'trace' command defines a
     tracepoint, which is a point in the target program where the
     debugger will briefly stop, collect some data, and then allow the
     program to continue.  Setting a tracepoint or changing its actions
     takes effect immediately if the remote stub supports the
     'InstallInTrace' feature (see install tracepoint in tracing).
     If remote stub doesn't support the 'InstallInTrace' feature, all
     these changes don't take effect until the next 'tstart' command,
     and once a trace experiment is running, further changes will not
     have any effect until the next trace experiment starts.  In
     addition, GDB supports "pending tracepoints"--tracepoints whose
     address is not yet resolved.  (This is similar to pending
     breakpoints.)  Pending tracepoints are not downloaded to the target
     and not installed until they are resolved.  The resolution of
     pending tracepoints requires GDB support--when debugging with the
     remote target, and GDB disconnects from the remote stub (see
     disconnected tracing), pending tracepoints can not be resolved
     (and downloaded to the remote stub) while GDB is disconnected.

     Here are some examples of using the 'trace' command:

          (gdb) trace foo.c:121    // a source file and line number

          (gdb) trace +2           // 2 lines forward

          (gdb) trace my_function  // first source line of function

          (gdb) trace *my_function // EXACT start address of function

          (gdb) trace *0x2117c4    // an address

     You can abbreviate 'trace' as 'tr'.

'trace LOCSPEC if COND'
     Set a tracepoint with condition COND; evaluate the expression COND
     each time the tracepoint is reached, and collect data only if the
     value is nonzero--that is, if COND evaluates as true.  See
     Tracepoint Conditions, for more information
     on tracepoint conditions.

'ftrace LOCSPEC [ if COND ]'
     The 'ftrace' command sets a fast tracepoint.  For targets that
     support them, fast tracepoints will use a more efficient but
     possibly less general technique to trigger data collection, such as
     a jump instruction instead of a trap, or some sort of hardware
     support.  It may not be possible to create a fast tracepoint at the
     desired location, in which case the command will exit with an
     explanatory message.

     GDB handles arguments to 'ftrace' exactly as for 'trace'.

     On 32-bit x86-architecture systems, fast tracepoints normally need
     to be placed at an instruction that is 5 bytes or longer, but can
     be placed at 4-byte instructions if the low 64K of memory of the
     target program is available to install trampolines.  Some Unix-type
     systems, such as GNU/Linux, exclude low addresses from the
     program's address space; but for instance with the Linux kernel it
     is possible to let GDB use this area by doing a 'sysctl' command to
     set the 'mmap_min_addr' kernel parameter, as in

          sudo sysctl -w vm.mmap_min_addr=32768

     which sets the low address to 32K, which leaves plenty of room for
     trampolines.  The minimum address should be set to a page boundary.

'strace [LOCSPEC | -m MARKER] [ if COND ]'
     The 'strace' command sets a static tracepoint.  For targets that
     support it, setting a static tracepoint probes a static
     instrumentation point, or marker, found at the code locations that
     result from resolving LOCSPEC.  It may not be possible to set a
     static tracepoint at the desired code location, in which case the
     command will exit with an explanatory message.

     GDB handles arguments to 'strace' exactly as for 'trace', with the
     addition that the user can also specify '-m MARKER' instead of a
     location spec.  This probes the marker identified by the MARKER
     string identifier.  This identifier depends on the static
     tracepoint backend library your program is using.  You can find all
     the marker identifiers in the 'ID' field of the 'info
     static-tracepoint-markers' command output.  See Listing Static Tracepoint Markers.
     For
     example, in the following small program using the UST tracing
     engine:

          main ()
          {
            trace_mark(ust, bar33, "str %s", "FOOBAZ");
          }

     the marker id is composed of joining the first two arguments to the
     'trace_mark' call with a slash, which translates to:

          (gdb) info static-tracepoint-markers
          Cnt Enb ID         Address            What
          1   n   ust/bar33  0x0000000000400ddc in main at stexample.c:22
                   Data: "str %s"
          [etc...]

     so you may probe the marker above with:

          (gdb) strace -m ust/bar33

     Static tracepoints accept an extra collect action -- 'collect
     $_sdata'.  This collects arbitrary user data passed in the probe
     point call to the tracing library.  In the UST example above,
     you'll see that the third argument to 'trace_mark' is a printf-like
     format string.  The user data is then the result of running that
     formatting string against the following arguments.  Note that 'info
     static-tracepoint-markers' command output lists that format string
     in the 'Data:' field.

     You can inspect this data when analyzing the trace buffer, by
     printing the $_sdata variable like any other variable available to
     GDB.  See Tracepoint Action Lists.

     The convenience variable '$tpnum' records the tracepoint number of
     the most recently set tracepoint.

'delete tracepoint [NUM]'
     Permanently delete one or more tracepoints.  With no argument, the
     default is to delete all tracepoints.  Note that the regular
     'delete' command can remove tracepoints also.

     Examples:

          (gdb) delete trace 1 2 3 // remove three tracepoints

          (gdb) delete trace       // remove all tracepoints

     You can abbreviate this command as 'del tr'.

13.1.2 Enable and Disable Tracepoints
-------------------------------------

These commands are deprecated; they are equivalent to plain 'disable'
and 'enable'.

'disable tracepoint [NUM]'
     Disable tracepoint NUM, or all tracepoints if no argument NUM is
     given.  A disabled tracepoint will have no effect during a trace
     experiment, but it is not forgotten.  You can re-enable a disabled
     tracepoint using the 'enable tracepoint' command.  If the command
     is issued during a trace experiment and the debug target has
     support for disabling tracepoints during a trace experiment, then
     the change will be effective immediately.  Otherwise, it will be
     applied to the next trace experiment.

'enable tracepoint [NUM]'
     Enable tracepoint NUM, or all tracepoints.  If this command is
     issued during a trace experiment and the debug target supports
     enabling tracepoints during a trace experiment, then the enabled
     tracepoints will become effective immediately.  Otherwise, they
     will become effective the next time a trace experiment is run.

13.1.3 Tracepoint Passcounts
----------------------------

'passcount [N [NUM]]'
     Set the "passcount" of a tracepoint.  The passcount is a way to
     automatically stop a trace experiment.  If a tracepoint's passcount
     is N, then the trace experiment will be automatically stopped on
     the N'th time that tracepoint is hit.  If the tracepoint number NUM
     is not specified, the 'passcount' command sets the passcount of the
     most recently defined tracepoint.  If no passcount is given, the
     trace experiment will run until stopped explicitly by the user.

     Examples:

          (gdb) passcount 5 2 // Stop on the 5th execution of
                                        // tracepoint 2

          (gdb) passcount 12  // Stop on the 12th execution of the
                                        // most recently defined tracepoint.
          (gdb) trace foo
          (gdb) pass 3
          (gdb) trace bar
          (gdb) pass 2
          (gdb) trace baz
          (gdb) pass 1        // Stop tracing when foo has been
                                         // executed 3 times OR when bar has
                                         // been executed 2 times
                                         // OR when baz has been executed 1 time.

13.1.4 Tracepoint Conditions
----------------------------

The simplest sort of tracepoint collects data every time your program
reaches a specified place.  You can also specify a "condition" for a
tracepoint.  A condition is just a Boolean expression in your
programming language (see Expressions).  A tracepoint
with a condition evaluates the expression each time your program reaches
it, and data collection happens only if the condition is true.

   Tracepoint conditions can be specified when a tracepoint is set, by
using 'if' in the arguments to the 'trace' command.  See Setting Tracepoints.
They can also be set or
changed at any time with the 'condition' command, just as with
breakpoints.

   Unlike breakpoint conditions, GDB does not actually evaluate the
conditional expression itself.  Instead, GDB encodes the expression into
an agent expression (see Agent Expressions) suitable for execution
on the target, independently of GDB.  Global variables become raw memory
locations, locals become stack accesses, and so forth.

   For instance, suppose you have a function that is usually called
frequently, but should not be called after an error has occurred.  You
could use the following tracepoint command to collect data about calls
of that function that happen while the error code is propagating through
the program; an unconditional tracepoint could end up collecting
thousands of useless trace frames that you would have to search through.

     (gdb) trace normal_operation if errcode > 0

13.1.5 Trace State Variables
----------------------------

A "trace state variable" is a special type of variable that is created
and managed by target-side code.  The syntax is the same as that for
GDB's convenience variables (a string prefixed with "$"), but they are
stored on the target.  They must be created explicitly, using a
'tvariable' command.  They are always 64-bit signed integers.

   Trace state variables are remembered by GDB, and downloaded to the
target along with tracepoint information when the trace experiment
starts.  There are no intrinsic limits on the number of trace state
variables, beyond memory limitations of the target.

   Although trace state variables are managed by the target, you can use
them in print commands and expressions as if they were convenience
variables; GDB will get the current value from the target while the
trace experiment is running.  Trace state variables share the same
namespace as other "$" variables, which means that you cannot have trace
state variables with names like '$23' or '$pc', nor can you have a trace
state variable and a convenience variable with the same name.

'tvariable $NAME [ = EXPRESSION ]'
     The 'tvariable' command creates a new trace state variable named
     '$NAME', and optionally gives it an initial value of EXPRESSION.
     The EXPRESSION is evaluated when this command is entered; the
     result will be converted to an integer if possible, otherwise GDB
     will report an error.  A subsequent 'tvariable' command specifying
     the same name does not create a variable, but instead assigns the
     supplied initial value to the existing variable of that name,
     overwriting any previous initial value.  The default initial value
     is 0.

'info tvariables'
     List all the trace state variables along with their initial values.
     Their current values may also be displayed, if the trace experiment
     is currently running.

'delete tvariable [ $NAME ... ]'
     Delete the given trace state variables, or all of them if no
     arguments are specified.

13.1.6 Tracepoint Action Lists
------------------------------

'actions [NUM]'
     This command will prompt for a list of actions to be taken when the
     tracepoint is hit.  If the tracepoint number NUM is not specified,
     this command sets the actions for the one that was most recently
     defined (so that you can define a tracepoint and then say 'actions'
     without bothering about its number).  You specify the actions
     themselves on the following lines, one action at a time, and
     terminate the actions list with a line containing just 'end'.  So
     far, the only defined actions are 'collect', 'teval', and
     'while-stepping'.

     'actions' is actually equivalent to 'commands' (see Breakpoint Command Lists),
     except that only the defined
     actions are allowed; any other GDB command is rejected.

     To remove all actions from a tracepoint, type 'actions NUM' and
     follow it immediately with 'end'.

          (gdb) collect DATA // collect some data

          (gdb) while-stepping 5 // single-step 5 times, collect data

          (gdb) end              // signals the end of actions.

     In the following example, the action list begins with 'collect'
     commands indicating the things to be collected when the tracepoint
     is hit.  Then, in order to single-step and collect additional data
     following the tracepoint, a 'while-stepping' command is used,
     followed by the list of things to be collected after each step in a
     sequence of single steps.  The 'while-stepping' command is
     terminated by its own separate 'end' command.  Lastly, the action
     list is terminated by an 'end' command.

          (gdb) trace foo
          (gdb) actions
          Enter actions for tracepoint 1, one per line:
          > collect bar,baz
          > collect $regs
          > while-stepping 12
            > collect $pc, arr[i]
            > end
          end

'collect[/MODS] EXPR1, EXPR2, ...'
     Collect values of the given expressions when the tracepoint is hit.
     This command accepts a comma-separated list of any valid
     expressions.  In addition to global, static, or local variables,
     the following special arguments are supported:

     '$regs'
          Collect all registers.

     '$args'
          Collect all function arguments.

     '$locals'
          Collect all local variables.

     '$_ret'
          Collect the return address.  This is helpful if you want to
          see more of a backtrace.

          _Note:_ The return address location can not always be reliably
          determined up front, and the wrong address / registers may end
          up collected instead.  On some architectures the reliability
          is higher for tracepoints at function entry, while on others
          it's the opposite.  When this happens, backtracing will stop
          because the return address is found unavailable (unless
          another collect rule happened to match it).

     '$_probe_argc'
          Collects the number of arguments from the static probe at
          which the tracepoint is located.  See Static Probe Points.

     '$_probe_argN'
          N is an integer between 0 and 11.  Collects the Nth argument
          from the static probe at which the tracepoint is located.
          See Static Probe Points.

     '$_sdata'
          Collect static tracepoint marker specific data.  Only
          available for static tracepoints.  See Tracepoint Action Lists.
          On the UST static tracepoints
          library backend, an instrumentation point resembles a 'printf'
          function call.  The tracing library is able to collect user
          specified data formatted to a character string using the
          format provided by the programmer that instrumented the
          program.  Other backends have similar mechanisms.  Here's an
          example of a UST marker call:

                const char master_name[] = "$your_name";
                trace_mark(channel1, marker1, "hello %s", master_name)

          In this case, collecting '$_sdata' collects the string 'hello
          $yourname'.  When analyzing the trace buffer, you can inspect
          '$_sdata' like any other variable available to GDB.

     You can give several consecutive 'collect' commands, each one with
     a single argument, or one 'collect' command with several arguments
     separated by commas; the effect is the same.

     The optional MODS changes the usual handling of the arguments.  's'
     requests that pointers to chars be handled as strings, in
     particular collecting the contents of the memory being pointed at,
     up to the first zero.  The upper bound is by default the value of
     the 'print characters' variable; if 's' is followed by a decimal
     number, that is the upper bound instead.  So for instance
     'collect/s25 mystr' collects as many as 25 characters at 'mystr'.

     The command 'info scope' (see info scope) is
     particularly useful for figuring out what data to collect.

'teval EXPR1, EXPR2, ...'
     Evaluate the given expressions when the tracepoint is hit.  This
     command accepts a comma-separated list of expressions.  The results
     are discarded, so this is mainly useful for assigning values to
     trace state variables (see Trace State Variables) without
     adding those values to the trace buffer, as would be the case if
     the 'collect' action were used.

'while-stepping N'
     Perform N single-step instruction traces after the tracepoint,
     collecting new data after each step.  The 'while-stepping' command
     is followed by the list of what to collect while stepping (followed
     by its own 'end' command):

          > while-stepping 12
            > collect $regs, myglobal
            > end
          >

     Note that '$pc' is not automatically collected by 'while-stepping';
     you need to explicitly collect that register if you need it.  You
     may abbreviate 'while-stepping' as 'ws' or 'stepping'.

'set default-collect EXPR1, EXPR2, ...'
     This variable is a list of expressions to collect at each
     tracepoint hit.  It is effectively an additional 'collect' action
     prepended to every tracepoint action list.  The expressions are
     parsed individually for each tracepoint, so for instance a variable
     named 'xyz' may be interpreted as a global for one tracepoint, and
     a local for another, as appropriate to the tracepoint's location.

'show default-collect'
     Show the list of expressions that are collected by default at each
     tracepoint hit.

13.1.7 Listing Tracepoints
--------------------------

'info tracepoints [NUM...]'
     Display information about the tracepoint NUM.  If you don't specify
     a tracepoint number, displays information about all the tracepoints
     defined so far.  The format is similar to that used for 'info
     breakpoints'; in fact, 'info tracepoints' is the same command,
     simply restricting itself to tracepoints.

     A tracepoint's listing may include additional information specific
     to tracing:

        * its passcount as given by the 'passcount N' command

        * the state about installed on target of each location

          (gdb) info trace
          Num     Type           Disp Enb Address    What
          1       tracepoint     keep y   0x0804ab57 in foo() at main.cxx:7
                  while-stepping 20
                    collect globfoo, $regs
                  end
                  collect globfoo2
                  end
                  pass count 1200
          2       tracepoint     keep y   <MULTIPLE>
                  collect $eip
          2.1                         y     0x0804859c in func4 at change-loc.h:35
                  installed on target
          2.2                         y     0xb7ffc480 in func4 at change-loc.h:35
                  installed on target
          2.3                         y     <PENDING>  set_tracepoint
          3       tracepoint     keep y   0x080485b1 in foo at change-loc.c:29
                  not installed on target
          (gdb)

     This command can be abbreviated 'info tp'.

13.1.8 Listing Static Tracepoint Markers
----------------------------------------

'info static-tracepoint-markers'
     Display information about all static tracepoint markers defined in
     the program.

     For each marker, the following columns are printed:

     _Count_
          An incrementing counter, output to help readability.  This is
          not a stable identifier.
     _ID_
          The marker ID, as reported by the target.
     _Enabled or Disabled_
          Probed markers are tagged with 'y'.  'n' identifies marks that
          are not enabled.
     _Address_
          Where the marker is in your program, as a memory address.
     _What_
          Where the marker is in the source for your program, as a file
          and line number.  If the debug information included in the
          program does not allow GDB to locate the source of the marker,
          this column will be left blank.

     In addition, the following information may be printed for each
     marker:

     _Data_
          User data passed to the tracing library by the marker call.
          In the UST backend, this is the format string passed as
          argument to the marker call.
     _Static tracepoints probing the marker_
          The list of static tracepoints attached to the marker.

          (gdb) info static-tracepoint-markers
          Cnt ID         Enb Address            What
          1   ust/bar2   y   0x0000000000400e1a in main at stexample.c:25
               Data: number1 %d number2 %d
               Probed by static tracepoints: #2
          2   ust/bar33  n   0x0000000000400c87 in main at stexample.c:24
               Data: str %s
          (gdb)

13.1.9 Starting and Stopping Trace Experiments
----------------------------------------------

'tstart'
     This command starts the trace experiment, and begins collecting
     data.  It has the side effect of discarding all the data collected
     in the trace buffer during the previous trace experiment.  If any
     arguments are supplied, they are taken as a note and stored with
     the trace experiment's state.  The notes may be arbitrary text, and
     are especially useful with disconnected tracing in a multi-user
     context; the notes can explain what the trace is doing, supply user
     contact information, and so forth.

'tstop'
     This command stops the trace experiment.  If any arguments are
     supplied, they are recorded with the experiment as a note.  This is
     useful if you are stopping a trace started by someone else, for
     instance if the trace is interfering with the system's behavior and
     needs to be stopped quickly.

     *Note*: a trace experiment and data collection may stop
     automatically if any tracepoint's passcount is reached (see
     Tracepoint Passcounts), or if the trace buffer becomes full.

'tstatus'
     This command displays the status of the current trace data
     collection.

   Here is an example of the commands we described so far:

     (gdb) trace gdb_c_test
     (gdb) actions
     Enter actions for tracepoint #1, one per line.
     > collect $regs,$locals,$args
     > while-stepping 11
       > collect $regs
       > end
     > end
     (gdb) tstart
     	[time passes ...]
     (gdb) tstop

   You can choose to continue running the trace experiment even if GDB
disconnects from the target, voluntarily or involuntarily.  For commands
such as 'detach', the debugger will ask what you want to do with the
trace.  But for unexpected terminations (GDB crash, network outage), it
would be unfortunate to lose hard-won trace data, so the variable
'disconnected-tracing' lets you decide whether the trace should continue
running without GDB.

'set disconnected-tracing on'
'set disconnected-tracing off'
     Choose whether a tracing run should continue to run if GDB has
     disconnected from the target.  Note that 'detach' or 'quit' will
     ask you directly what to do about a running trace no matter what
     this variable's setting, so the variable is mainly useful for
     handling unexpected situations, such as loss of the network.

'show disconnected-tracing'
     Show the current choice for disconnected tracing.

   When you reconnect to the target, the trace experiment may or may not
still be running; it might have filled the trace buffer in the meantime,
or stopped for one of the other reasons.  If it is running, it will
continue after reconnection.

   Upon reconnection, the target will upload information about the
tracepoints in effect.  GDB will then compare that information to the
set of tracepoints currently defined, and attempt to match them up,
allowing for the possibility that the numbers may have changed due to
creation and deletion in the meantime.  If one of the target's
tracepoints does not match any in GDB, the debugger will create a new
tracepoint, so that you have a number with which to specify that
tracepoint.  This matching-up process is necessarily heuristic, and it
may result in useless tracepoints being created; you may simply delete
them if they are of no use.

   If your target agent supports a "circular trace buffer", then you can
run a trace experiment indefinitely without filling the trace buffer;
when space runs out, the agent deletes already-collected trace frames,
oldest first, until there is enough room to continue collecting.  This
is especially useful if your tracepoints are being hit too often, and
your trace gets terminated prematurely because the buffer is full.  To
ask for a circular trace buffer, simply set 'circular-trace-buffer' to
on.  You can set this at any time, including during tracing; if the
agent can do it, it will change buffer handling on the fly, otherwise it
will not take effect until the next run.

'set circular-trace-buffer on'
'set circular-trace-buffer off'
     Choose whether a tracing run should use a linear or circular buffer
     for trace data.  A linear buffer will not lose any trace data, but
     may fill up prematurely, while a circular buffer will discard old
     trace data, but it will have always room for the latest tracepoint
     hits.

'show circular-trace-buffer'
     Show the current choice for the trace buffer.  Note that this may
     not match the agent's current buffer handling, nor is it guaranteed
     to match the setting that might have been in effect during a past
     run, for instance if you are looking at frames from a trace file.

'set trace-buffer-size N'
'set trace-buffer-size unlimited'
     Request that the target use a trace buffer of N bytes.  Not all
     targets will honor the request; they may have a compiled-in size
     for the trace buffer, or some other limitation.  Set to a value of
     'unlimited' or '-1' to let the target use whatever size it likes.
     This is also the default.

'show trace-buffer-size'
     Show the current requested size for the trace buffer.  Note that
     this will only match the actual size if the target supports
     size-setting, and was able to handle the requested size.  For
     instance, if the target can only change buffer size between runs,
     this variable will not reflect the change until the next run
     starts.  Use 'tstatus' to get a report of the actual buffer size.

'set trace-user TEXT'

'show trace-user'

'set trace-notes TEXT'
     Set the trace run's notes.

'show trace-notes'
     Show the trace run's notes.

'set trace-stop-notes TEXT'
     Set the trace run's stop notes.  The handling of the note is as for
     'tstop' arguments; the set command is convenient way to fix a stop
     note that is mistaken or incomplete.

'show trace-stop-notes'
     Show the trace run's stop notes.

13.1.10 Tracepoint Restrictions
-------------------------------

There are a number of restrictions on the use of tracepoints.  As
described above, tracepoint data gathering occurs on the target without
interaction from GDB.  Thus the full capabilities of the debugger are
not available during data gathering, and then at data examination time,
you will be limited by only having what was collected.  The following
items describe some common problems, but it is not exhaustive, and you
may run into additional difficulties not mentioned here.

   * Tracepoint expressions are intended to gather objects (lvalues).
     Thus the full flexibility of GDB's expression evaluator is not
     available.  You cannot call functions, cast objects to aggregate
     types, access convenience variables or modify values (except by
     assignment to trace state variables).  Some language features may
     implicitly call functions (for instance Objective-C fields with
     accessors), and therefore cannot be collected either.

   * Collection of local variables, either individually or in bulk with
     '$locals' or '$args', during 'while-stepping' may behave
     erratically.  The stepping action may enter a new scope (for
     instance by stepping into a function), or the location of the
     variable may change (for instance it is loaded into a register).
     The tracepoint data recorded uses the location information for the
     variables that is correct for the tracepoint location.  When the
     tracepoint is created, it is not possible, in general, to determine
     where the steps of a 'while-stepping' sequence will advance the
     program--particularly if a conditional branch is stepped.

   * Collection of an incompletely-initialized or partially-destroyed
     object may result in something that GDB cannot display, or displays
     in a misleading way.

   * When GDB displays a pointer to character it automatically
     dereferences the pointer to also display characters of the string
     being pointed to.  However, collecting the pointer during tracing
     does not automatically collect the string.  You need to explicitly
     dereference the pointer and provide size information if you want to
     collect not only the pointer, but the memory pointed to.  For
     example, '*ptr@50' can be used to collect the 50 element array
     pointed to by 'ptr'.

   * It is not possible to collect a complete stack backtrace at a
     tracepoint.  Instead, you may collect the registers and a few
     hundred bytes from the stack pointer with something like
     '*(unsigned char *)$esp@300' (adjust to use the name of the actual
     stack pointer register on your target architecture, and the amount
     of stack you wish to capture).  Then the 'backtrace' command will
     show a partial backtrace when using a trace frame.  The number of
     stack frames that can be examined depends on the sizes of the
     frames in the collected stack.  Note that if you ask for a block so
     large that it goes past the bottom of the stack, the target agent
     may report an error trying to read from an invalid address.

   * If you do not collect registers at a tracepoint, GDB can infer that
     the value of '$pc' must be the same as the address of the
     tracepoint and use that when you are looking at a trace frame for
     that tracepoint.  However, this cannot work if the tracepoint has
     multiple locations (for instance if it was set in a function that
     was inlined), or if it has a 'while-stepping' loop.  In those cases
     GDB will warn you that it can't infer '$pc', and default it to
     zero.

13.2 Using the Collected Data
=============================

After the tracepoint experiment ends, you use GDB commands for examining
the trace data.  The basic idea is that each tracepoint collects a trace
"snapshot" every time it is hit and another snapshot every time it
single-steps.  All these snapshots are consecutively numbered from zero
and go into a buffer, and you can examine them later.  The way you
examine them is to "focus" on a specific trace snapshot.  When the
remote stub is focused on a trace snapshot, it will respond to all GDB
requests for memory and registers by reading from the buffer which
belongs to that snapshot, rather than from _real_ memory or registers of
the program being debugged.  This means that *all* GDB commands
('print', 'info registers', 'backtrace', etc.)  will behave as if we
were currently debugging the program state as it was when the tracepoint
occurred.  Any requests for data that are not in the buffer will fail.

13.2.1 'tfind N'
----------------

The basic command for selecting a trace snapshot from the buffer is
'tfind N', which finds trace snapshot number N, counting from zero.  If
no argument N is given, the next snapshot is selected.

   Here are the various forms of using the 'tfind' command.

'tfind start'
     Find the first snapshot in the buffer.  This is a synonym for
     'tfind 0' (since 0 is the number of the first snapshot).

'tfind none'
     Stop debugging trace snapshots, resume _live_ debugging.

'tfind end'
     Same as 'tfind none'.

'tfind'
     No argument means find the next trace snapshot or find the first
     one if no trace snapshot is selected.

'tfind -'
     Find the previous trace snapshot before the current one.  This
     permits retracing earlier steps.

'tfind tracepoint NUM'
     Find the next snapshot associated with tracepoint NUM.  Search
     proceeds forward from the last examined trace snapshot.  If no
     argument NUM is given, it means find the next snapshot collected
     for the same tracepoint as the current snapshot.

'tfind pc ADDR'
     Find the next snapshot associated with the value ADDR of the
     program counter.  Search proceeds forward from the last examined
     trace snapshot.  If no argument ADDR is given, it means find the
     next snapshot with the same value of PC as the current snapshot.

'tfind outside ADDR1, ADDR2'
     Find the next snapshot whose PC is outside the given range of
     addresses (exclusive).

'tfind range ADDR1, ADDR2'
     Find the next snapshot whose PC is between ADDR1 and ADDR2
     (inclusive).

'tfind line [FILE:]N'
     Find the next snapshot associated with the source line N.  If the
     optional argument FILE is given, refer to line N in that source
     file.  Search proceeds forward from the last examined trace
     snapshot.  If no argument N is given, it means find the next line
     other than the one currently being examined; thus saying 'tfind
     line' repeatedly can appear to have the same effect as stepping
     from line to line in a _live_ debugging session.

   The default arguments for the 'tfind' commands are specifically
designed to make it easy to scan through the trace buffer.  For
instance, 'tfind' with no argument selects the next trace snapshot, and
'tfind -' with no argument selects the previous trace snapshot.  So, by
giving one 'tfind' command, and then simply hitting <RET> repeatedly you
can examine all the trace snapshots in order.  Or, by saying 'tfind -'
and then hitting <RET> repeatedly you can examine the snapshots in
reverse order.  The 'tfind line' command with no argument selects the
snapshot for the next source line executed.  The 'tfind pc' command with
no argument selects the next snapshot with the same program counter (PC)
as the current frame.  The 'tfind tracepoint' command with no argument
selects the next trace snapshot collected by the same tracepoint as the
current one.

   In addition to letting you scan through the trace buffer manually,
these commands make it easy to construct GDB scripts that scan through
the trace buffer and print out whatever collected data you are
interested in.  Thus, if we want to examine the PC, FP, and SP registers
from each trace frame in the buffer, we can say this:

     (gdb) tfind start
     (gdb) while ($trace_frame != -1)
     > printf "Frame %d, PC = %08X, SP = %08X, FP = %08X\n", \
               $trace_frame, $pc, $sp, $fp
     > tfind
     > end

     Frame 0, PC = 0020DC64, SP = 0030BF3C, FP = 0030BF44
     Frame 1, PC = 0020DC6C, SP = 0030BF38, FP = 0030BF44
     Frame 2, PC = 0020DC70, SP = 0030BF34, FP = 0030BF44
     Frame 3, PC = 0020DC74, SP = 0030BF30, FP = 0030BF44
     Frame 4, PC = 0020DC78, SP = 0030BF2C, FP = 0030BF44
     Frame 5, PC = 0020DC7C, SP = 0030BF28, FP = 0030BF44
     Frame 6, PC = 0020DC80, SP = 0030BF24, FP = 0030BF44
     Frame 7, PC = 0020DC84, SP = 0030BF20, FP = 0030BF44
     Frame 8, PC = 0020DC88, SP = 0030BF1C, FP = 0030BF44
     Frame 9, PC = 0020DC8E, SP = 0030BF18, FP = 0030BF44
     Frame 10, PC = 00203F6C, SP = 0030BE3C, FP = 0030BF14

   Or, if we want to examine the variable 'X' at each source line in the
buffer:

     (gdb) tfind start
     (gdb) while ($trace_frame != -1)
     > printf "Frame %d, X == %d\n", $trace_frame, X
     > tfind line
     > end

     Frame 0, X = 1
     Frame 7, X = 2
     Frame 13, X = 255

13.2.2 'tdump'
--------------

This command takes no arguments.  It prints all the data collected at
the current trace snapshot.

     (gdb) trace 444
     (gdb) actions
     Enter actions for tracepoint #2, one per line:
     > collect $regs, $locals, $args, gdb_long_test
     > end

     (gdb) tstart

     (gdb) tfind line 444
     #0  gdb_test (p1=0x11, p2=0x22, p3=0x33, p4=0x44, p5=0x55, p6=0x66)
     at gdb_test.c:444
     444        printp( "%s: arguments = 0x%X 0x%X 0x%X 0x%X 0x%X 0x%X\n", )

     (gdb) tdump
     Data collected at tracepoint 2, trace frame 1:
     d0             0xc4aa0085       -995491707
     d1             0x18     24
     d2             0x80     128
     d3             0x33     51
     d4             0x71aea3d        119204413
     d5             0x22     34
     d6             0xe0     224
     d7             0x380035 3670069
     a0             0x19e24a 1696330
     a1             0x3000668        50333288
     a2             0x100    256
     a3             0x322000 3284992
     a4             0x3000698        50333336
     a5             0x1ad3cc 1758156
     fp             0x30bf3c 0x30bf3c
     sp             0x30bf34 0x30bf34
     ps             0x0      0
     pc             0x20b2c8 0x20b2c8
     fpcontrol      0x0      0
     fpstatus       0x0      0
     fpiaddr        0x0      0
     p = 0x20e5b4 "gdb-test"
     p1 = (void *) 0x11
     p2 = (void *) 0x22
     p3 = (void *) 0x33
     p4 = (void *) 0x44
     p5 = (void *) 0x55
     p6 = (void *) 0x66
     gdb_long_test = 17 '\021'

     (gdb)

   'tdump' works by scanning the tracepoint's current collection actions
and printing the value of each expression listed.  So 'tdump' can fail,
if after a run, you change the tracepoint's actions to mention variables
that were not collected during the run.

   Also, for tracepoints with 'while-stepping' loops, 'tdump' uses the
collected value of '$pc' to distinguish between trace frames that were
collected at the tracepoint hit, and frames that were collected while
stepping.  This allows it to correctly choose whether to display the
basic list of collections, or the collections from the body of the
while-stepping loop.  However, if '$pc' was not collected, then 'tdump'
will always attempt to dump using the basic collection list, and may
fail if a while-stepping frame does not include all the same data that
is collected at the tracepoint hit.

13.2.3 'save tracepoints FILENAME'
----------------------------------

This command saves all current tracepoint definitions together with
their actions and passcounts, into a file 'FILENAME' suitable for use in
a later debugging session.  To read the saved tracepoint definitions,
use the 'source' command (see Command Files).  The
'save-tracepoints' command is a deprecated alias for 'save tracepoints'

13.3 Convenience Variables for Tracepoints
==========================================

'(int) $trace_frame'
     The current trace snapshot (a.k.a. "frame") number, or -1 if no
     snapshot is selected.

'(int) $tracepoint'
     The tracepoint for the current trace snapshot.

'(int) $trace_line'
     The line number for the current trace snapshot.

'(char []) $trace_file'
     The source file for the current trace snapshot.

'(char []) $trace_func'
     The name of the function containing '$tracepoint'.

   Note: '$trace_file' is not suitable for use in 'printf', use 'output'
instead.

   Here's a simple example of using these convenience variables for
stepping through all the trace snapshots and printing some of their
data.  Note that these are not the same as trace state variables, which
are managed by the target.

     (gdb) tfind start

     (gdb) while $trace_frame != -1
     > output $trace_file
     > printf ", line %d (tracepoint #%d)\n", $trace_line, $tracepoint
     > tfind
     > end

13.4 Using Trace Files
======================

In some situations, the target running a trace experiment may no longer
be available; perhaps it crashed, or the hardware was needed for a
different activity.  To handle these cases, you can arrange to dump the
trace data into a file, and later use that file as a source of trace
data, via the 'target tfile' command.

'tsave [ -r ] FILENAME'
'tsave [-ctf] DIRNAME'
     Save the trace data to FILENAME.  By default, this command assumes
     that FILENAME refers to the host filesystem, so if necessary GDB
     will copy raw trace data up from the target and then save it.  If
     the target supports it, you can also supply the optional argument
     '-r' ("remote") to direct the target to save the data directly into
     FILENAME in its own filesystem, which may be more efficient if the
     trace buffer is very large.  (Note, however, that 'target tfile'
     can only read from files accessible to the host.)  By default, this
     command will save trace frame in tfile format.  You can supply the
     optional argument '-ctf' to save data in CTF format.  The "Common
     Trace Format" (CTF) is proposed as a trace format that can be
     shared by multiple debugging and tracing tools.  Please go to
     'http://www.efficios.com/ctf' to get more information.

'target tfile FILENAME'
'target ctf DIRNAME'
     Use the file named FILENAME or directory named DIRNAME as a source
     of trace data.  Commands that examine data work as they do with a
     live target, but it is not possible to run any new trace
     experiments.  'tstatus' will report the state of the trace run at
     the moment the data was saved, as well as the current trace frame
     you are examining.  Both FILENAME and DIRNAME must be on a
     filesystem accessible to the host.

     The FILENAME and DIRNAME arguments supports escaping and quoting,
     see Filenames As Command Arguments.

          (gdb) target ctf ctf.ctf
          (gdb) tfind
          Found trace frame 0, tracepoint 2
          39            ++a;  /* set tracepoint 1 here */
          (gdb) tdump
          Data collected at tracepoint 2, trace frame 0:
          i = 0
          a = 0
          b = 1 '\001'
          c = {"123", "456", "789", "123", "456", "789"}
          d = {{{a = 1, b = 2}, {a = 3, b = 4}}, {{a = 5, b = 6}, {a = 7, b = 8}}}
          (gdb) p b
          $1 = 1

14 Debugging Programs That Use Overlays
***************************************

If your program is too large to fit completely in your target system's
memory, you can sometimes use "overlays" to work around this problem.
GDB provides some support for debugging programs that use overlays.

14.1 How Overlays Work
======================

Suppose you have a computer whose instruction address space is only 64
kilobytes long, but which has much more memory which can be accessed by
other means: special instructions, segment registers, or memory
management hardware, for example.  Suppose further that you want to
adapt a program which is larger than 64 kilobytes to run on this system.

   One solution is to identify modules of your program which are
relatively independent, and need not call each other directly; call
these modules "overlays".  Separate the overlays from the main program,
and place their machine code in the larger memory.  Place your main
program in instruction memory, but leave at least enough space there to
hold the largest overlay as well.

   Now, to call a function located in an overlay, you must first copy
that overlay's machine code from the large memory into the space set
aside for it in the instruction memory, and then jump to its entry point
there.

         Data             Instruction            Larger
     Address Space       Address Space        Address Space
     +-----------+       +-----------+        +-----------+
     |           |       |           |        |           |
     +-----------+       +-----------+        +-----------+<-- overlay 1
     | program   |       |   main    |   .----| overlay 1 | load address
     | variables |       |  program  |   |    +-----------+
     | and heap  |       |           |   |    |           |
     +-----------+       |           |   |    +-----------+<-- overlay 2
     |           |       +-----------+   |    |           | load address
     +-----------+       |           |   |  .-| overlay 2 |
                         |           |   |  | |           |
              mapped --->+-----------+   |  | +-----------+
              address    |           |   |  | |           |
                         |  overlay  | <-'  | |           |
                         |   area    |  <---' +-----------+<-- overlay 3
                         |           | <---.  |           | load address
                         +-----------+     `--| overlay 3 |
                         |           |        |           |
                         +-----------+        |           |
                                              +-----------+
                                              |           |
                                              +-----------+

                         A code overlay

   The diagram (see A code overlay) shows a system with separate
data and instruction address spaces.  To map an overlay, the program
copies its code from the larger address space to the instruction address
space.  Since the overlays shown here all use the same mapped address,
only one may be mapped at a time.  For a system with a single address
space for data and instructions, the diagram would be similar, except
that the program variables and heap would share an address space with
the main program and the overlay area.

   An overlay loaded into instruction memory and ready for use is called
a "mapped" overlay; its "mapped address" is its address in the
instruction memory.  An overlay not present (or only partially present)
in instruction memory is called "unmapped"; its "load address" is its
address in the larger memory.  The mapped address is also called the
"virtual memory address", or "VMA"; the load address is also called the
"load memory address", or "LMA".

   Unfortunately, overlays are not a completely transparent way to adapt
a program to limited instruction memory.  They introduce a new set of
global constraints you must keep in mind as you design your program:

   * Before calling or returning to a function in an overlay, your
     program must make sure that overlay is actually mapped.  Otherwise,
     the call or return will transfer control to the right address, but
     in the wrong overlay, and your program will probably crash.

   * If the process of mapping an overlay is expensive on your system,
     you will need to choose your overlays carefully to minimize their
     effect on your program's performance.

   * The executable file you load onto your system must contain each
     overlay's instructions, appearing at the overlay's load address,
     not its mapped address.  However, each overlay's instructions must
     be relocated and its symbols defined as if the overlay were at its
     mapped address.  You can use GNU linker scripts to specify
     different load and relocation addresses for pieces of your program;
     see Overlay Description (ld.info).

   * The procedure for loading executable files onto your system must be
     able to load their contents into the larger address space as well
     as the instruction and data spaces.

   The overlay system described above is rather simple, and could be
improved in many ways:

   * If your system has suitable bank switch registers or memory
     management hardware, you could use those facilities to make an
     overlay's load area contents simply appear at their mapped address
     in instruction space.  This would probably be faster than copying
     the overlay to its mapped area in the usual way.

   * If your overlays are small enough, you could set aside more than
     one overlay area, and have more than one overlay mapped at a time.

   * You can use overlays to manage data, as well as instructions.  In
     general, data overlays are even less transparent to your design
     than code overlays: whereas code overlays only require care when
     you call or return to functions, data overlays require care every
     time you access the data.  Also, if you change the contents of a
     data overlay, you must copy its contents back out to its load
     address before you can copy a different data overlay into the same
     mapped area.

14.2 Overlay Commands
=====================

To use GDB's overlay support, each overlay in your program must
correspond to a separate section of the executable file.  The section's
virtual memory address and load memory address must be the overlay's
mapped and load addresses.  Identifying overlays with sections allows
GDB to determine the appropriate address of a function or variable,
depending on whether the overlay is mapped or not.

   GDB's overlay commands all start with the word 'overlay'; you can
abbreviate this as 'ov' or 'ovly'.  The commands are:

'overlay off'
     Disable GDB's overlay support.  When overlay support is disabled,
     GDB assumes that all functions and variables are always present at
     their mapped addresses.  By default, GDB's overlay support is
     disabled.

'overlay manual'
     Enable "manual" overlay debugging.  In this mode, GDB relies on you
     to tell it which overlays are mapped, and which are not, using the
     'overlay map-overlay' and 'overlay unmap-overlay' commands
     described below.

'overlay map-overlay OVERLAY'
'overlay map OVERLAY'
     Tell GDB that OVERLAY is now mapped; OVERLAY must be the name of
     the object file section containing the overlay.  When an overlay is
     mapped, GDB assumes it can find the overlay's functions and
     variables at their mapped addresses.  GDB assumes that any other
     overlays whose mapped ranges overlap that of OVERLAY are now
     unmapped.

'overlay unmap-overlay OVERLAY'
'overlay unmap OVERLAY'
     Tell GDB that OVERLAY is no longer mapped; OVERLAY must be the name
     of the object file section containing the overlay.  When an overlay
     is unmapped, GDB assumes it can find the overlay's functions and
     variables at their load addresses.

'overlay auto'
     Enable "automatic" overlay debugging.  In this mode, GDB consults a
     data structure the overlay manager maintains in the inferior to see
     which overlays are mapped.  For details, see Automatic Overlay Debugging.

'overlay load-target'
'overlay load'
     Re-read the overlay table from the inferior.  Normally, GDB
     re-reads the table GDB automatically each time the inferior stops,
     so this command should only be necessary if you have changed the
     overlay mapping yourself using GDB.  This command is only useful
     when using automatic overlay debugging.

'overlay list-overlays'
'overlay list'
     Display a list of the overlays currently mapped, along with their
     mapped addresses, load addresses, and sizes.

   Normally, when GDB prints a code address, it includes the name of the
function the address falls in:

     (gdb) print main
     $3 = {int ()} 0x11a0 <main>
When overlay debugging is enabled, GDB recognizes code in unmapped
overlays, and prints the names of unmapped functions with asterisks
around them.  For example, if 'foo' is a function in an unmapped
overlay, GDB prints it this way:

     (gdb) overlay list
     No sections are mapped.
     (gdb) print foo
     $5 = {int (int)} 0x100000 <*foo*>
When 'foo''s overlay is mapped, GDB prints the function's name normally:

     (gdb) overlay list
     Section .ov.foo.text, loaded at 0x100000 - 0x100034,
             mapped at 0x1016 - 0x104a
     (gdb) print foo
     $6 = {int (int)} 0x1016 <foo>

   When overlay debugging is enabled, GDB can find the correct address
for functions and variables in an overlay, whether or not the overlay is
mapped.  This allows most GDB commands, like 'break' and 'disassemble',
to work normally, even on unmapped code.  However, GDB's breakpoint
support has some limitations:

   * You can set breakpoints in functions in unmapped overlays, as long
     as GDB can write to the overlay at its load address.
   * GDB can not set hardware or simulator-based breakpoints in unmapped
     overlays.  However, if you set a breakpoint at the end of your
     overlay manager (and tell GDB which overlays are now mapped, if you
     are using manual overlay management), GDB will re-set its
     breakpoints properly.

14.3 Automatic Overlay Debugging
================================

GDB can automatically track which overlays are mapped and which are not,
given some simple co-operation from the overlay manager in the inferior.
If you enable automatic overlay debugging with the 'overlay auto'
command (see Overlay Commands), GDB looks in the inferior's memory
for certain variables describing the current state of the overlays.

   Here are the variables your overlay manager must define to support
GDB's automatic overlay debugging:

'_ovly_table':
     This variable must be an array of the following structures:

          struct
          {
            /* The overlay's mapped address.  */
            unsigned long vma;

            /* The size of the overlay, in bytes.  */
            unsigned long size;

            /* The overlay's load address.  */
            unsigned long lma;

            /* Non-zero if the overlay is currently mapped;
               zero otherwise.  */
            unsigned long mapped;
          }

'_novlys':
     This variable must be a four-byte signed integer, holding the total
     number of elements in '_ovly_table'.

   To decide whether a particular overlay is mapped or not, GDB looks
for an entry in '_ovly_table' whose 'vma' and 'lma' members equal the
VMA and LMA of the overlay's section in the executable file.  When GDB
finds a matching entry, it consults the entry's 'mapped' member to
determine whether the overlay is currently mapped.

   In addition, your overlay manager may define a function called
'_ovly_debug_event'.  If this function is defined, GDB will silently set
a breakpoint there.  If the overlay manager then calls this function
whenever it has changed the overlay table, this will enable GDB to
accurately keep track of which overlays are in program memory, and
update any breakpoints that may be set in overlays.  This will allow
breakpoints to work even if the overlays are kept in ROM or other
non-writable memory while they are not being executed.