| The absolute debugger, adb, is not specifically a kernel tool. It is a general-purpose debugger. It allows the user to specify an executable file and an optional core file, then examine and modify the contents of the core file and control execution of the executable. However, when the executable file is vmunix and the core file is an HP-UX core dump or /dev/mem, then adb can be used to examine kernel variables and structures. For the purpose of examining the kernel, adb can be used either on a core dump or on the running kernel. If you wish to work with a core dump, change directory to the location of the dump and use the command adb m vmunix (including the trailing period). The m specifies a multifile dump image, vmunix is the name of the executable, and (the current directory) is the location of the dump. If you want to examine the running kernel, use adb k /stand/vmunix /dev/mem. Optionally, you can include the w parameter, indicating you wish to be able to modify the kernel or memory images. This should be used with extreme caution modifying kernel memory can cause a system panic or worse. Commands in adb are cryptic even by UNIX standards. Most versions of adb don't even have a prompt, so there's no indication that you're running adb. The newer versions of adb use adb> as a prompt so that you'll know where you are. They also remind you upon startup that $q is used to quit and $h is help. The built-in help tells you that the command format is [address expr][,count][command][modifier]. The address expression is usually either a symbol (such as main or proc) or an address (such as 0x7f003843). The most common commands are / for examining values from the memory image and ? for examining values from the kernel executable. The modifier for these two commands is the format in which the output should be displayed. Table 16-1 lists some of the more commonly used formats supported by adb. Table 16-1. adb FormatsFormat Specifier | Meaning |
|---|
a | Print the symbolic name for the address. | b | Print one byte in hexadecimal. | B | Print one byte in octal. | d | Print two bytes in decimal. | D | Print four bytes in decimal. | i | Print the mnemonic for the instruction at the given address. | o | Print two bytes in octal. | O | Print four bytes in octal. | s | Print a zero-terminated string. | x | Print two bytes in hexadecimal. | X | Print four bytes in hexadecimal. | Y | Print a date/time value. |
The count field after the address is the number of times the command should be repeated. You can also put a count on the modifier. Be aware that the count on the address is assumed to be hexadecimal, and the one on the modifier is assumed to be decimal. For example, realmain,20?i decodes the first 32 instructions from realmain, and realmain?20i decodes the first 20 instructions from realmain. Because of this ambiguity in the default base for numbers in adb, it's always a good idea to explicitly state the base you're using by prefacing numbers with 0x for hex and 0d for decimal. adb can be handy for examining kernel tunables. The command nproc/D gives you the current value of the nproc tunable, maxdsiz/D gives you the current maxdsiz value, and so on. In a few cases, adb can be used to modify tunables as well. This doesn't work for all tunable values; for example, if a tunable is used at boot time to determine how big to make a system table, then changing it later isn't going to help. In fact, changing it to a bigger value later might cause a system panic if the kernel runs off the end of the table. Also be aware that changing a tunable in the running kernel only changes the kernel image in memory, not the kernel file on disk. The next time you reboot and the kernel is reloaded, you'll be back to the old values. To be able to modify values, you must have used the w switch when you ran adb. This is an extra safeguard to keep you from accidentally modifying values. You should use w on the command line only if you plan to be changing things. One example of a tunable you can change on the fly is st_ats_enabled, which enables the automatic tape-sharing mechanism in the tape driver. This flag is checked on every tape open, so changing it affects all future tape operations. To enable it, type st_ats_enabled/W 1, and to disable it, type st_ats_enabled/W 0. And, of course, you can check the current state of the flag with st_ats_enabled/X. |
