crash(1M) crash(1M)
NAME
crash - examine system images
SYNOPSIS
/usr/sbin/crash [ -d dumpfile ] [ -n namelist ] [ -w ]
DESCRIPTION
The crash command is used to examine the system memory image of a
running or a crashed system by formatting and printing control
structures, tables, and other information. Command line arguments to
crash are dumpfile, namelist, and outputfile.
dumpfile is the file containing the system memory image. The default
dumpfile is /dev/mem.
The text file namelist contains the symbol table information needed
for symbolic access to the system memory image to be examined. The
default namelist is /stand/unix. If a system image from another
machine is to be examined, the corresponding text file must be copied
from that machine.
When the crash command is invoked, a session is initiated. The output
from a crash session is directed to outputfile. The default
outputfile is the standard output.
Input during a crash session is of the form:
function [ argument... ]
where function is one of the crash functions described in the
``FUNCTIONS'' subsection of this manual page, and arguments are
qualifying data that indicate which items of the system image are to
be printed.
The default for process-related items is the current process for a
running system or the process that was running at the time of the
crash for a crashed system. If the contents of a table are being
dumped, the default is all active table entries.
The following function options are available to crash functions
wherever they are semantically valid.
-e Display every entry in a table.
-f Display the full structure.
-p Interpret all address arguments in the command line as
physical addresses. If they are not physical addresses,
results are inconsistent.
8/91 Page 1
crash(1M) crash(1M)
-s process
Specify a process slot other than the default.
-w file Redirect the output of a function to file.
The functions mode, defproc, and redirect correspond to the function
options -p, -s, and -w. The mode function may be used to set the
address translation mode to physical or virtual for all subsequently
entered functions; defproc sets the value of the process slot
argument for subsequent functions; and redirect redirects all
subsequent output.
Output from crash functions may be piped to another program in the
following way:
function [ argument... ] ! shell_command
For example,
mount ! grep rw
writes all mount table entries with an rw flag to the standard
output. The redirection option (-w) cannot be used with this
feature.
Depending on the context of the function, numeric arguments are
assumed to be in a specific radix. Counts are assumed to be decimal.
Addresses are always hexadecimal. Table address arguments larger
than the size of the function table are interpreted as hexadecimal
addresses; those smaller are assumed to be decimal slots in the
table. Default bases on all arguments may be overridden. The C
conventions for designating the bases of numbers are recognized. A
number that is usually interpreted as decimal is interpreted as
hexadecimal if it is preceded by 0x and as octal if it is preceded by
0. Decimal override is designated by 0d, and binary by 0b.
Aliases for functions may be any uniquely identifiable initial
substring of the function name. Traditional aliases of one letter,
such as p for proc, remain valid.
Many functions accept different forms of entry for the same argument.
Requests for table information accept a table entry number, a
physical address, a virtual address, a symbol, a range, or an
expression. A range of slot numbers may be specified in the form a-b
where a and b are decimal numbers. An expression consists of two
operands and an operator. An operand may be an address, a symbol, or
a number; the operator may be +, -, *, /, &, or | . An operand that
is a number should be preceded by a radix prefix if it is not a
decimal number (0 for octal, 0x for hexadecimal, 0b for binary). The
expression must be enclosed in parentheses. Other functions accept
any of these argument forms that are meaningful.
Page 2 8/91
crash(1M) crash(1M)
Two abbreviated arguments to crash functions are used throughout.
Both accept data entered in several forms. They may be expanded into
the following:
table_entry = table entry | address | symbol | range |
expression
start_addr = address | symbol | expression
FUNCTIONS
? [-w file]
List available functions.
!command
Escape to the shell and execute command.
as [-e] [-f] [-w file] [proc...]
Print information on process segments.
base [-w file] number ...
Print number in binary, octal, decimal, and hexadecimal. A
number in a radix other than decimal should be preceded by a
prefix that indicates its radix as follows: 0x, hexadecimal;
0, octal; and 0b, binary.
buffer [-w file] [-format] bufferslot
buffer [-w file] [-format] [-p]start_addr
Alias: b.
Print the contents of a buffer in the designated format. The
following format designations are recognized: -b, byte: -c,
character; -d, decimal; -x, hexadecimal; -o, octal; and, -i,
inode. If no format is given, the previous format is used.
The default format at the beginning of a crash session is
hexadecimal.
bufhdr [-f] [-w file] [[-p]table_entry...]
Alias: buf.
Print system buffer headers. The -f option produces different
output depending on whether the buffer is local or remote
(contains RFS data).
callout [-w file]
Alias: c.
Print the callout table.
class [-w file] [table_entry...]
Print information about process scheduler classes.
8/91 Page 3
crash(1M) crash(1M)
dbfree [-w file] [class ... ]
Print free streams data block headers. If a class is entered,
only data block headers for the class specified is printed.
dblock [-e] [-w file] [-c class...]
dblock [-e] [-w file] [[-p] table_entry...]
Print allocated streams data block headers. If the class
option (-c) is used, only data block headers for the class
specified is printed.
defproc [-w file] [-c]
defproc [-w file] [slot]
Set the value of the process slot argument. The process slot
argument may be set to the current slot number (-c) or the slot
number may be specified. If no argument is entered, the value
of the previously set slot number is printed. At the start of
a crash session, the process slot is set to the current
process.
dis [-w file] [-a] start_addr [count]
dis [-w file] [-a] -c [count]
Disassemble count instructions starting at start_addr. The
default count is 1. The absolute option (-a) specifies a non-
symbolic disassembly. The -c option can be used in place of
start_addr to continue disassembly at the address at which a
previous disassembly ended.
dispq [-w file] [table_entry...]
Print the dispatcher (scheduler) queues.
ds [-w file] virtual_address ...
Print the data symbol whose address is closest to, but not
greater than, the address entered.
file [-e] [-w file] [[-p]table_entry...]
Alias: f.
Print the file table.
findaddr [-w file] table slot
Print the address of slot in table. Only tables available to
the size function are available to findaddr.
findslot [-w file] virtual_address ...
Print the table, entry slot number, and offset for the address
entered. Only tables available to the size function are
available to findslot.
Page 4 8/91
crash(1M) crash(1M)
fs [-w file] [[-p]table_entry...]
Print the file system information table.
gdp [-e] [-f] [-w file] [[-p]table_entry...]
Print the gift descriptor protocol table.
help [-w file] function ...
Print a description of the named function, including syntax and
aliases.
inode [-e] [-f] [-w file] [[-p]table_entry...]
Alias: i.
Print the inode table, including file system switch
information.
kfp [-w file] [-s process] [-r]
kfp [-w file] [-s process] [value]
Print the kernel frame pointer (kfp) for the start of a kernel
stack trace. The kfp value can be set using the value argument
or the reset option (-r), which sets the kfp from the saved kfp
in the dumpfile. If no argument is entered, the current value
of the kfp is printed.
kmastat [-w file]
Print kernel memory allocator statistics.
lck [-e] [-w file] [[-p]table_entry...]
Alias: l.
Print record locking information. If the -e option is used or
table address arguments are given, the record lock list is
printed. If no argument is entered, information on locks
relative to inodes is printed.
linkblk [-e] [-w file] [[-p]table_entry...]
Print the linkblk table.
major [-w file] [entry ...]
Print the MAJOR table.
map [-w file] mapname ...
Print the map structure of the given mapname.
mbfree [-w file]
Print free streams message block headers.
mblock [-e] [-w file] [[-p]table_entry...]
Print allocated streams message block headers.
8/91 Page 5
crash(1M) crash(1M)
mode [-w file] [mode]
Set address translation of arguments to virtual (v) or physical
(p) mode. If no mode argument is given, the current mode is
printed. At the start of a crash session, the mode is virtual.
mount [-e] [-w file] [[-p]table_entry...]
Alias: m, vfs.
Print information about mounted file systems.
nm [-w file] symbol ...
Print value and type for the given symbol.
od [-p] [-w file] [-format] [-mode] [-s process] start_addr [count]
Alias: rd.
Print count values starting at start_addr in one of the
following formats: character (-c), decimal (-d), hexadecimal
(-x), octal (-o), ASCII (-a), or hexadecimal/character (-h),
and one of the following modes: long (-l), short (-t), or byte
(-b). The default mode for character and ASCII formats is
byte; the default mode for decimal, hexadecimal, and octal
formats is long. The format -h prints both hexadecimal and
character representations of the addresses dumped; no mode
needs to be specified. When format or mode is omitted, the
previous value is used. At the start of a crash session, the
format is hexadecimal and the mode is long. If no count is
entered, 1 is assumed.
page [-e] [-wfile] [[-p] table_entry ...]
Print information about pages.
pcb [-w file] [process]
Print the process control block. If no arguments are given,
the active pcb for the current process is printed.
prnode [-e] [-w file] [[-p] table_entry...]
Print information about the private data of processes being
traced.
proc [-e] [-f] [-w file] [[-p] table_entry ... #procid ...]
proc [-f] [-w file] [-r]
Alias: p.
Print the process table. Process table information may be
specified in two ways. First, any mixture of table entries and
process IDs may be entered. Each process ID must be preceded by
a #. Alternatively, process table information for runnable
processes may be specified with the runnable option (-r).
ptbl [-w file] [-sprocess] ste [count]
Page 6 8/91
crash(1M) crash(1M)
ptbl [-w file] [-sprocess] [-p] addr [count]
Print information on page descriptor tables, where ste is the
segment table entry.
pty [-f] [-e] [-w file] [-s] [-h] [-l]
Print the pseudo ttys presently configured. The -l, -s and -h
options give information about the STREAMS modules ldterm, ptem
and pckt, respectively.
qrun [-w file]
Print the list of scheduled streams queues.
queue [-e] [-w file] [[-p]table_entry...]
Print streams queues.
quit Alias: q.
Terminate the crash session.
rcvd [-e] [-f] [-w file] [[-p]table_entry...]
Print the receive descriptor table.
rduser [-e] [-f] [-w file] [[-p]table_entry...]
Print the receive descriptor user table.
regs [-w file] [-g] [-s] [-m] [-f] [-a]
Print Motorola M68000 family of processors and co-processor
registers including the general, supervisor, mmu, and floating
point registers. The (-a) option prints all of the register
groups.
redirect [-w file] [-c]
redirect [-w file] [newfile]
Used with a file name, redirects output of a crash session to
newfile. If no argument is given, the file name to which
output is being redirected is printed. Alternatively, the
close option (-c) closes the previously set file and redirects
output to the standard output.
resource [-e] [-w file] [[-p]table_entry...]
Print the advertise table.
rtdptbl [-w file] [table_entry...]
Print the real-time scheduler parameter table. See
rtdptbl(4).
rtproc [-w file]
Print information about processes in the real-time scheduler
class.
8/91 Page 7
crash(1M) crash(1M)
sdt [-e] [-w file] [-s process] [-p start_addr] [count]
The segment descriptor table for the named memory section is
printed. Alternatively, the segment descriptor table starting
at start_addr for count entries is printed. If no count is
given, a count of 1 is assumed.
search [-p] [-w file] [-m mask] [-s process] pattern start_addr length
Print the words in memory that match pattern, beginning at the
start_addr for length words. The mask is ANDed (&) with each
memory word and the result compared against the pattern. The
mask defaults to 0xffffffff.
size [-w file] [-x] [structure_name ... ]
Print the size of the designated structure. The (-x) option
prints the size in hexadecimal. If no argument is given, a
list of the structure names for which sizes are available is
printed.
sndd [-e] [-f] [-w file] [[-p]table_entry...]
Print the send descriptor table.
snode [-e] [-f] [-w file] [[-p]table_entry...]
Print information about open special files.
srmount [-e] [-w file] [[-p]table_entry...]
Print the server mount table.
stack [-w file] [-u] [process]
stack [-w file] [-k] [process]
stack [-w file] [[-p]-i start_addr]
Alias: s.
Dump the stack. The (-u) option prints the user stack. The
(-k) option prints the kernel stack. The (-i) option prints
the interrupt stack. If no arguments are entered, the kernel
stack for the current process is printed. The interrupt stack
and the stack for the current process are not available on a
running system.
stream [-e] [-f] [-w file] [[-p]table_entry...]
Print the streams table.
strstat [-w file]
Print streams statistics.
trace [-w file] [-r] [process]
trace [-w file] [[-p]-istart_addr]
Alias: t.
Print stack trace. The kfp value is used with the -r option;
Page 8 8/91
crash(1M) crash(1M)
the kfp function prints or sets the kfp (kernel frame pointer)
value. The interrupt option prints a trace of the interrupt
stack beginning at start_addr. The interrupt stack trace and
the stack trace for the current process are not available on a
running system.
ts [-w file] virtual_address ...
Print text symbol closest to the designated address.
tsdptbl [-w file] [table_entry...]
Print the time-sharing scheduler parameter table. See
tsdptbl(4).
tsproc [-w file]
Print information about processes in the time-sharing scheduler
class.
tty [-e] [-f] [-l] [-w file] [-ttype[[-p]table_entry...]]
tty [-e] [-f] [-l] [-w file] [[-p]start_addr]
Valid types: iu.
Print the tty table. If no arguments are given, the tty table
for the console tty type is printed. If the -t option is used,
the table for the single tty type specified is printed. If no
argument follows the type option, all entries in the table are
printed. A single tty entry may be specified using start_addr.
The -l option prints the line discipline information.
uinode [-e] [-f] [-w file] [[-p]table_entry...]
Alias: ui.
Print the ufs inode table.
user [-f] [-w file] [process]
Alias: u.
Print the ublock for the designated process.
var [-w file]
Alias: v.
Print the tunable system parameters.
vfs [-e] [-w file] [[-p]table_entry...]
Alias: mount, m.
Print information about mounted file systems.
vfssw [-w file] [[-p]table_entry...]
Print information about configured file system types.
vnode [-w file] [[-p]vnode_addr...]
Print information about vnodes.
8/91 Page 9
crash(1M) crash(1M)
vtop [-w file] [-s process] start_addr...
Print the physical address translation of the virtual address
start_addr.
FILES
/dev/mem system image of currently running system
/dev/rmt/ctape1 used to access system image on cartridge tape
/dev/swap used to access system image in swap partition
SEE ALSO
ldsysdump(1M)
Page 10 8/91