NAME

crash − examine system images

SYNOPSIS

/etc/crash [ system ] [ namelist ] [ ka6 ]

DESCRIPTION

Crash is an interactive utility for examining an operating system core image.  It has facilities for interpreting and formating the various control structures in the system and certain miscellaneous functions that are useful when perusing a dump. 

The arguments to crash are the file name where the system image can be found, a namelist file to be used for symbol values, and the segment address of the initial process to be examined.  The current process can be changed via subsequent commands.  The default values are /dev/mem, /unix, and the location of the swapper, process 0; hence, crash with no arguments can be used to examine an active system.  If a system image file is given, it is assumed to be a system core dump and the initial process is set to be that of the process running at the time of the crash.  This is determined by the value of ka6 stored in a fixed location by the system dump mechanism. 

COMMANDS

Input to crash is typically of the form:

command [ options ] [ structures to be printed ]. 
When allowed, options will modify the format of the print out. If no specific structure elements are specified, all valid entries will be used. As an example, proc − 12 15 3 would print process table slots 12, 15 and 3 in a long format, while proc would print the entire process table in the standard format.  The current repertory consists of:

ka6 [ segment address ]
Print the location of the current process if no argument is given, or set the location to that of the supplied value.

u Print the user structure of the current process as determined by the value of ka6.

trace[−r]
Generate a kernel stack trace of the current process. If the −r option is used, the trace begins at the saved stack frame pointer in r5.  Otherwise the trace starts at the bottom of the stack and attempts to find valid stack frames deeper in the stack. 

r5 [ stack frame ]
Print the program’s idea of the start of the current stack frame (set initially from a fixed location in the dump) if no argument is given, or set the frame pointer to the supplied value.

stack Format an octal dump of the kernel stack of the current process.  The addresses shown are virtual system data addresses rather than true physical locations. 

proc [ −[r] ] [ list of process table entries ]
Format the process table. The −r option causes only runnable processes to be printed.  The − alone generates a longer listing. 

inode [ − ] [ list of inode table entries ]
Format the inode table. The − option will also print the inode data block addresses. 

file [ list of file table entries ]
Format the file table.

mount [ list of mount table entries ]
Format the mount table.

text [ list of text table entries ]
Format the text table.

tty [ type ] [ − ] [ list of tty entries ]
Print the tty structures. The type argument determines which structure will be used (such as kl or dh; the last type is remembered).  The − option prints the stty parameters for the given line. 

stat Print certain statistics found in the dump.  These include the panic string, time of crash, system name, and the registers saved in low memory by the dump mechanism. 

var Print the tunable system parameters. 

buf [ list of buffer headers ]
Format the system buffer headers.

buffer [ format ] [ list of buffers ]
Print the data in a system buffer according to format. Valid formats include decimal, octal, character, byte, directory, inode, and write.  The last creates a file containing the buffer data. 

callout
Print all entries in the callout table.

map [ list of map names ]
Format the named system map structures.

nm [ list of symbols ]
Print symbol value and type as found in the namelist file.

ts [ list of text addresses ]
Find the closest text symbols to the given addresses.

ds [ list of data addresses ]
Find the closest data symbols to the given addresses.

od [ symbol or data address ] [ count ] [ format ]
Dump count data values starting at the symbol value or address given according to format. Allowable formats are octal, decimal, character, or byte. 

!  Escape to shell. 

q Exit from crash.

?  Print synopsis of commands. 

ALIASES

There are built in aliases for many of the commands and formats.  In general, the first letter of a name is satisfactory, thus, k is a shorthand notation for kernel.  Exceptions are x for text and e for decimal. 

FILES

/dev/memdefault system image file
/unixdefault namelist file
buf.#files created containing buffer data

SEE ALSO

crash(8). 

May 16, 1980