NAME

kadb − kernel debugger

SYNOPSIS

kadb [−llogfil] [−p] [−w] [-Idir] [objfil [corfil]]

DESCRIPTION

kadb is a version of adb(1) that specializes in CX/UX kernels and stand-alone utilities. 

Objfil is normally an executable kernel image containing a symbol table.  The default for objfil is /unix. Corfil may be - (to specify that no core file is to be used), /dev/mem (to examine the currently running system); a physical memory image produced by savecore(1M) (to analyze a system crash); or a tty line connected to the remote port of another machine’s console.  In this last case, kadb can control the execution of the system under test (SUT) in much the same way that adb controls the execution of a process.  The default for corfil is /dev/mem. If the −w flag is present then both objfil and corfil are opened for reading and writing. 

Requests to kadb are read from the standard input and responses are written to the standard output.  The −l option names a log file that captures everything written to the standard output, creating a record of the debug session. 

The −I option specifies a directory where files to be read with $< or $<< (see below) will be sought; the default is /usr/lib/adb. 

The −p option tells kadb that the addresses contained in the object file’s symbol table are physical addresses rather than virtual addresses.  Stand-alone utilities that run in physical-mode can be debugged with this option. 

kadb ignores QUIT; INTERRUPT causes return to the next command. 

In general requests to kadb are of the form

[address]  [, count] [command] [;]

If address is present then dot is set to address. Initially dot is set to 0.  For most commands count specifies how many times the command will be executed.  The default count is 1.  Address and count are expressions. 

The interpretation of an address depends on the context it is used in.  If the −p option was specified, addresses are physical.  Otherwise, addresses are virtual and are mapped relative to the "current" process.  When kadb is first invoked, the current process is the one that happened to be running when the system crashed or the CPU halted.  Kadb’s notion of the current process may be changed. 

EXPRESSIONS

. The value of dot.

+ The value of dot incremented by the current increment. 

^ The value of dot decremented by the current increment. 

" The last address typed. 

integer A number.  The prefixes 0o and 0O force interpretation in octal radix; the prefixes 0t and 0T force interpretation in decimal radix; the prefixes 0x and 0X force interpretation in hexadecimal radix.  Thus 0o20 = 0t16 = 0x10 = sixteen.  If no prefix appears, then the default radix is used; see the $d command.  The default radix is initially hexadecimal.  The hexadecimal digits are 0123456789abcdefABCDEF with the obvious values.  Note that a hexadecimal number whose most significant digit would otherwise be an alphabetic character must have a 0x (or 0X) prefix (or a leading zero if the default radix is hexadecimal). 

integer.fraction
A 32 bit floating point number.

´cccc´ The ASCII value of up to 4 characters.  \ may be used to escape a ´. 

< name The value of name, which is either a variable name or a register name. kadb maintains a number of variables (see VARIABLES) named by single letters or digits.  If name is a register name then the value of the register is obtained from the corfil. The register names are those printed by the $r and $R commands.

symbol A symbol is a sequence of upper or lower case letters, underscores or digits, not starting with a digit.  The backslash character \ may be used to escape other characters.  The value of the symbol is taken from the symbol table in objfil. An initial _ will be prepended to symbol if needed. 

_ symbol
In C, the ‘true name’ of an external symbol begins with _. It may be necessary to utter this name to distinguish it from internal or hidden variables of a program.

(exp) The value of the expression exp.

Monadic operators

∗exp The contents of the location addressed by exp in corfil.

@exp The contents of the location addressed by exp in objfil.

−exp Integer negation. 

~exp Bitwise complement. 

#exp Logical negation. 

Dyadic operators are left associative and are less binding than monadic operators. 

e1+e2 Integer addition. 

e1−e2 Integer subtraction. 

e1∗e2 Integer multiplication. 

e1%e2 Integer division. 

e1&e2 Bitwise conjunction. 

e1│e2 Bitwise disjunction. 

e1#e2 E1 rounded up to the next multiple of e2.

COMMANDS

Most commands consist of a verb followed by a modifier or list of modifiers.  The following verbs are available.  (The commands ‘?’ and ‘/’ may be followed by ‘∗’; see ADDRESSES for further details.) 

?f Locations starting at address in objfil are printed according to the format f. dot is incremented by the sum of the increments for each format letter (q.v.). 

/f Locations starting at address in corfil are printed according to the format f and dot is incremented as for ‘?’. 

=f The value of address itself is printed in the styles indicated by the format f. (For i format ‘?’ is printed for the parts of the instruction that reference subsequent words.) 

A format consists of one or more characters that specify a style of printing.  Each format character may be preceded by a DECIMAL integer that is a repeat count for the format character.  While stepping through a format dot is incremented by the amount given for each format letter.  If no format is given then the last format is used.  The format letters available are as follows. 

o2 Print 2 bytes in octal. 

O4 Print 4 bytes in octal. 

q2 Print in signed octal. 

Q4 Print long signed octal. 

d2 Print in decimal. 

D4 Print long decimal. 

x2 Print 2 bytes in hexadecimal. 

X4 Print 4 bytes in hexadecimal. 

u2 Print as an unsigned decimal number. 

U4 Print long unsigned decimal. 

f4 Print the 32 bit value as a floating point number. 

F8 Print double floating point. 

k4 Print 4 bytes as a fixed decimal point number (a data type used by the kernel to represent non-integer values). 

b1 Print the addressed byte in octal. 

c1 Print the addressed character. 

C1 Print the addressed character using the standard escape convention where control characters are printed as ^x and the delete character is printed as ^?. 

sn Print the addressed characters until a zero character is reached. 

Sn Print a string using the ^x escape convention (see C above).  n is the length of the string including its zero terminator. 

Y4 Print 4 bytes in date format (see ctime(3C)). 

in Print as machine instructions.  n is the number of bytes occupied by the instruction.  This style of printing causes variables 1 and 2 to be set to the offset parts of the source and destination respectively. 

a0 Print the value of dot in symbolic form.  Symbols are checked to ensure that they have an appropriate type as indicated below. 

/local or global data symbol
?local or global text symbol
=local or global absolute symbol

p4 Print the addressed value in symbolic form using the same rules for symbol lookup as a. 

t0 When preceded by an integer tabs to the next appropriate tab stop.  For example, 8t moves to the next 8-space tab stop. 

r0 Print a space. 

n0 Print a newline. 

"..." 0
Print the enclosed string.

^ Dot is decremented by the current increment.  Nothing is printed. 

+ Dot is incremented by 1.  Nothing is printed. 

− Dot is decremented by 1.  Nothing is printed. 

newline
Repeat the previous command with a count of 1. 

[?/]l value mask
Words starting at dot are masked with mask and compared with value until a match is found.  If L is used then the match is for 4 bytes at a time instead of 2.  If no match is found then dot is unchanged; otherwise dot is set to the matched location.  If mask is omitted then −1 is used. 

[?/]w value ...
Write the 2-byte value into the addressed location.  If the command is W, write 4 bytes. 

>name
Dot is assigned to the variable or register named. 

! A shell (/bin/sh) is called to read the rest of the line following ‘!’. 

$modifier
Miscellaneous commands.  The available modifiers are:

<f Read commands from the file f. If this command is executed in a file, further commands in the file are not seen. If f is omitted, the current input stream is terminated.  If a count is given, and is zero, the command will be ignored.  The value of the count will be placed in variable 9 before the first command in f is executed. 

<<f Similar to < except it can be used in a file of commands without causing the file to be closed.  Variable 9 is saved during the execution of this command, and restored when it completes.  There is a (small) finite limit to the number of << files that can be open at once. 

>f Append output to the file f, which is created if it does not exist.  If f is omitted, output is returned to the terminal. 

? Prints a summary of the $ collection of commands. 

r Print the general registers and the instruction addressed by pc.  Dot is set to pc. 

R Print the privileged registers and the instruction addressed by pc.  Dot is set to pc. 

b f Print the extended floating-point registers and the instruction addressed by pc.  Dot is set to pc.  These registers only exist on Series 5000 systems.  This command simply prints the general registers on Series 4000 systems. 

Print all breakpoints and their associated counts and commands. 

c C stack backtrace.  If address is given then it is taken as the address of the current frame instead of the contents of the frame−pointer register.  If count is given then only the first count frames are printed. 

d Set the default radix to address and report the new value.  Note that address is interpreted in the (old) current radix.  Thus “10$d” never changes the default radix.  To make decimal the default radix, use “0t10$d”. 

e The names and values of external variables are printed. 

w Set the page width for output to address (default 80). 

s Set the limit for symbol matches to address (default 32767). 

q Exit from kadb. 

v Print all non-zero variables in the default radix. 

m Print the address map. 

p Change the current CPU context.  The address argument is a physical CPU identifier.  Changing context causes $r to print the new CPU’s registers, $c to trace the new CPU’s stack, etc. 

t Show the translation of the virtual address argument into a physical address. 

:modifier
Manage a subprocess.  Available modifiers are:

bc Set breakpoint at address. The breakpoint is executed count−1 times before causing a stop. Each time the breakpoint is encountered the command c is executed.  If this command is omitted or sets dot to zero then the breakpoint causes a stop. 

d Delete breakpoint at address.

D Delete all breakpoints. 

r In adb this command creates a new process and begins execution of the program under test.  In kadb this command enters a "virtual terminal mode", conversing directly with the test machine’s console.  You may then enter the commands necessary to boot the machine ("h.y." and so on).  Actually, what’s done in this virtual terminal mode is irrelevant to kadb.  For example, you could drop into a conversation with the console simply to use its low-level debugging features.  VIRTUAL TERMINAL MODE SHOULD ONLY BE EXITTED WHEN THE SYSTEM UNDER TEST IS HALTED.  Exit by typing ctrl ^. 

c Execution of the test machine is continued.  The CPU is started and virtual terminal mode is entered.  kadb cannot detect when the system under test hits a breakpoint (it counts on YOU to do this), and therefore assumes that the CPU is halted when virtual terminal mode is exitted.  If address is given execution continues at this address.  Count breakpoints are skipped before the machine is halted. 

s As for c except that the test machine is single stepped count times.  The remainder of the line is treated as a command to be executed after each step.  For example, ",0t10:s .?I" will single step the test machine 10 times and print the next instruction to be executed at each step. 

? Prints a summary of the : commands. 

‘modifier
CX/UX-specific commands, most of which print various kernel data structures.  For these commands to be effective, kadb must "match" the kernel being debugged.  Available modifiers are:

<struct> [-f]
Prints count kernel data structures starting at address. The structure name may be any one of callout, sema, proc, inode, vnode, file, vfs, buf, uio, tty, region, pfdat, mem_pool, swaptab, map, cpu, mbuf, socket, inpcb, or tcpcb.  Structures that live in tables allocated at compile time or boot time may be addressed by their index into the table.  For example, if the proc table lives at location 0xc0e36200, then "0xc0e36200‘proc" prints the first proc table entry, but so does "0‘proc".  Dot is incremented by the size of the structure, so that subsequent entries in a table may be viewed by just entering a newline.  The −f option prints a "full" description of some of the structures, rather than the default short description. 

<table> -t [-f]
Prints the first count "interesting" entries in a table.  The table name may be any one of callout, hrt_callout, sema, proc, inode, file, vfs, buf, vioc, mp16, mp32, xty, pty, cons, region, mem_pool, swaptab, or cpu. 

user [-acefrsx]
Print various portions the U area belonging to the current process. If address is given, first switch to the process whose proc structure is located at address. Options include

a Print everything mentioned below. 

c Print system call information. 

e Print arguments and environment. 

f Print the open file table. 

r Print resource usage information. 

s Print the signal state. 

x Print executable file information. 

pid Switch to the process whose PID is given by address.

session
Prints the session structure of the current process, followed by a list of the processes in the session.  If address is given, print the session structure and list of session members of the process whose proc structure is located at address.

kma [-f]
Print kernel memory allocator information.  This displays the status information contained in the kmeminfo structure as defined in the file sys/sysinfo.h.  With the -f option, free-list verification is done and also the amount of buffers on each non-empty free-list is printed. 

size Prints the sizes of various kernel data structures and tables. 

stat Prints general system statistics and identification. 

sysinfo
Prints the sysinfo structure.

trace [-t]
Prints the trace buffer (the kernel must have been built with the TRACE compilation flag).  With the −t option, this command prints the entire trace buffer in reverse chronological order.  If count is given, only the first count records are printed.  Without the −t option, count records are printed beginning at address. Dot is incremented by the size of record, so subsequent records may be viewed by just entering a newline. 

auxsema
Prints the auxiliary semaphore data structures containing contention data (the kernel must have been built with the SEMA_STATS compilation flag).  By default, one (long) line is printed for every semaphore and every spin-lock in the kernel.  Options may be used to restrict the output; that is, print only those semaphores or spin-locks with

a n At least n arrivals. 

A n At most n arrivals. 

b n At least n blocks. 

B n At most n blocks. 

f n At least n% failure rate. 

F n At most n% failure rate. 

i n Initialized at code address n. 

l n At location >= n. 

L n At location <= n. 

t n Type of n. 

? Prints a summary of the ‘ commands. 

VARIABLES

kadb provides a number of variables.  Named variables are set initially by kadb but are not used subsequently.  Numbered variables are reserved for communication as follows. 

0 The last value printed. 

1 The last offset part of an instruction source. 

2 The previous value of variable 1. 

9 The count on the last $< or $<< command. 

On entry the following are set from the system header in the objfil.

b The base address of the data segment. 

d The data segment size. 

e The entry point. 

m The ‘magic’ number (0407, 0410 or 0413). 

s The stack segment size. 

t The text segment size. 

ADDRESSES

The address in a file associated with a written address is determined by a mapping associated with that file.  Each mapping is represented by two triples (b1, e1, f1) and (b2, e2, f2) and the file address corresponding to a written address is calculated as follows. 

b1≤address<e1 => file address=address+f1−b1, otherwise,

b2≤address<e2 => file address=address+f2−b2,

otherwise, the requested address is not legal.  In some cases (e.g. for programs with separated I and D space) the two segments for a file may overlap.  If a ? or / is followed by an ∗ then only the second triple is used. 

NOTES

If the high resolution timing facility is configured into the currently executing kernel, the system time reported from the resource utilization information will exclude or include time spent servicing interrupts, depending on what the system timing mode is set to. See hirestmode(2) and CX/UX Programmer’s Guide for more information on the high resolution timing facility. 

FILES

/unix
/dev/mem
vmcore.x
/usr/lib/adb/∗

SEE ALSO

cc(1), dbx(1), savecore(1M), a.out(4), "Using ADB to Debug the UNIX Kernel" by Samuel J. Leffler and William N. Joy

DIAGNOSTICS

Kadb when there is no current command or format.  Comments about inaccessible files, syntax errors, abnormal termination of commands, etc.  Exit status is 0, unless last command failed or returned nonzero status. 

CX/UX User’s Reference Manual