crash(1M) MISC. REFERENCE MANUAL PAGES crash(1M)
NAME
crash - examine system images
SYNOPSIS
/usr/sbin/crash [ -d dumpfile ] [ -n namelist ] [ -w ]
DESCRIPTION
The crash command is used to examine the system memory image
of a running or a crashed system by formatting and printing
control structures, tables, and other information. Command
line arguments to crash are dumpfile, namelist, and output-
file.
dumpfile is the file containing the system memory image.
The default dumpfile is /dev/mem. The system image can also
be /dev/ifdsk06, if the first floppy of a system dump is
taken with the sysdump firmware command; or it can be the
pathname of a file produced by the ldsysdump command.
The text file namelist contains the symbol table information
needed for symbolic access to the system memory image to be
examined. The default namelist is /stand/unix. If a system
image from another machine is to be examined, the
corresponding text file must be copied from that machine.
When the crash command is invoked, a session is initiated.
The output from a crash session is directed to outputfile.
The default outputfile is the standard output.
Input during a crash session is of the form:
function [ argument... ]
where function is one of the crash functions described in
the ``FUNCTIONS'' subsection of this manual page, and argu-
ments are qualifying data that indicate which items of the
system image are to be printed.
The default for process-related items is the current process
for a running system or the process that was running at the
time of the crash for a crashed system. If the contents of
a table are being dumped, the default is all active table
entries.
The following function options are available to crash func-
tions wherever they are semantically valid.
-e Display every entry in a table.
-f Display the full structure.
-p Interpret all address arguments in the command
Last change: System Administration Utilities 1
crash(1M) MISC. REFERENCE MANUAL PAGES crash(1M)
line as physical addresses. If they are not phy-
sical addresses, results are inconsistent.
-s process
Specify a process slot other than the default.
-w file Redirect the output of a function to file.
The functions mode, defproc, and redirect correspond to the
function options -p, -s, and -w. The mode function may be
used to set the address translation mode to physical or vir-
tual for all subsequently entered functions; defproc sets
the value of the process slot argument for subsequent func-
tions; and redirect redirects all subsequent output.
Output from crash functions may be piped to another program
in the following way:
function [ argument... ] ! shell_command
For example,
mount ! grep rw
writes all mount table entries with an rw flag to the stan-
dard output. The redirection option (-w) cannot be used
with this feature.
Depending on the context of the function, numeric arguments
are assumed to be in a specific radix. Counts are assumed
to be decimal. Addresses are always hexadecimal. Table
address arguments larger than the size of the function table
are interpreted as hexadecimal addresses; those smaller are
assumed to be decimal slots in the table. Default bases on
all arguments may be overridden. The C conventions for
designating the bases of numbers are recognized. A number
that is usually interpreted as decimal is interpreted as
hexadecimal if it is preceded by 0x and as octal if it is
preceded by 0. Decimal override is designated by 0d, and
binary by 0b.
Aliases for functions may be any uniquely identifiable ini-
tial substring of the function name. Traditional aliases of
one letter, such as p for proc, remain valid.
Many functions accept different forms of entry for the same
argument. Requests for table information accept a table
entry number, a physical address, a virtual address, a sym-
bol, a range, or an expression. A range of slot numbers may
be specified in the form a-b where a and b are decimal
numbers. An expression consists of two operands and an
operator. An operand may be an address, a symbol, or a
Last change: System Administration Utilities 2
crash(1M) MISC. REFERENCE MANUAL PAGES crash(1M)
number; the operator may be +, -, *, /, &, or | . An
operand that is a number should be preceded by a radix pre-
fix if it is not a decimal number (0 for octal, 0x for hexa-
decimal, 0b for binary). The expression must be enclosed in
parentheses. Other functions accept any of these argument
forms that are meaningful.
Two abbreviated arguments to crash functions are used
throughout. Both accept data entered in several forms.
They may be expanded into the following:
table_entry = table entry | address | symbol | range |
expression
start_addr = address | symbol | expression
FUNCTIONS
? [-w file]
List available functions.
!command
Escape to the shell and execute command.
as [-e] [-f] [-w file] [proc...]
Print information on process segments.
base [-w file] number ...
Print number in binary, octal, decimal, and hexade-
cimal. A number in a radix other than decimal should be
preceded by a prefix that indicates its radix as fol-
lows: 0x, hexadecimal; 0, octal; and 0b, binary.
buffer [-w file] [-format] bufferslot
buffer [-w file] [-format] [-p]start_addr
Alias: b.
Print the contents of a buffer in the designated for-
mat. The following format designations are recognized:
-b, byte: -c, character; -d, decimal; -x, hexadecimal;
-o, octal; and, -i, inode. If no format is given, the
previous format is used. The default format at the
beginning of a crash session is hexadecimal.
bufhdr [-f] [-w file] [[-p]table_entry...]
Alias: buf.
Print system buffer headers. The -f option produces
different output depending on whether the buffer is
local or remote (contains RFS data).
callout [-w file]
Alias: c.
Print the callout table.
Last change: System Administration Utilities 3
crash(1M) MISC. REFERENCE MANUAL PAGES crash(1M)
class [-w file] [table_entry...]
Print information about process scheduler classes.
dbfree [-w file] [class ... ]
Print free streams data block headers. If a class is
entered, only data block headers for the class speci-
fied is printed.
dblock [-e] [-w file] [-c class...]
dblock [-e] [-w file] [[-p] table_entry...]
Print allocated streams data block headers. If the
class option (-c) is used, only data block headers for
the class specified is printed.
defproc [-w file] [-c]
defproc [-w file] [slot]
Set the value of the process slot argument. The pro-
cess slot argument may be set to the current slot
number (-c) or the slot number may be specified. If no
argument is entered, the value of the previously set
slot number is printed. At the start of a crash ses-
sion, the process slot is set to the current process.
dis [-w file] [-a] start_addr [count]
dis [-w file] [-a] -c [count]
Disassemble count instructions starting at start_addr.
The default count is 1. The absolute option (-a)
specifies a non-symbolic disassembly. The -c option
can be used in place of start_addr to continue
disassembly at the address at which a previous
disassembly ended.
dispq [-w file] [table_entry...]
Print the dispatcher (scheduler) queues.
ds [-w file] virtual_address ...
Print the data symbol whose address is closest to, but
not greater than, the address entered.
file [-e] [-w file] [[-p]table_entry...]
Alias: f.
Print the file table.
findaddr [-w file] table slot
Print the address of slot in table. Only tables avail-
able to the size function are available to findaddr.
findslot [-w file] virtual_address ...
Print the table, entry slot number, and offset for the
Last change: System Administration Utilities 4
crash(1M) MISC. REFERENCE MANUAL PAGES crash(1M)
address entered. Only tables available to the size
function are available to findslot.
fs [-w file] [[-p]table_entry...]
Print the file system information table.
gdp [-e] [-f] [-w file] [[-p]table_entry...]
Print the gift descriptor protocol table.
help [-w file] function ...
Print a description of the named function, including
syntax and aliases.
inode [-e] [-f] [-w file] [[-p]table_entry...]
Alias: i.
Print the inode table, including file system switch
information.
kfp [-w file] [-s process] [-r]
kfp [-w file] [-s process] [value]
Print the kernel frame pointer (kfp) for the start of a
kernel stack trace. The kfp value can be set using the
value argument or the reset option (-r), which sets the
kfp through the nvram (non-volatile RAM). If no argu-
ment is entered, the current value of the kfp is
printed.
kmastat [-w file]
Print kernel memory allocator statistics.
lck [-e] [-w file] [[-p]table_entry...]
Alias: l.
Print record locking information. If the -e option is
used or table address arguments are given, the record
lock list is printed. If no argument is entered,
information on locks relative to inodes is printed.
linkblk [-e] [-w file] [[-p]table_entry...]
Print the linkblk table.
major [-w file] [entry ...]
Print the MAJOR table.
map [-w file] mapname ...
Print the map structure of the given mapname.
mbfree [-w file]
Print free streams message block headers.
mblock [-e] [-w file] [[-p]table_entry...]
Print allocated streams message block headers.
Last change: System Administration Utilities 5
crash(1M) MISC. REFERENCE MANUAL PAGES crash(1M)
mmu [-w file]
Alias: regs.
Print memory management unit registers. These regis-
ters are not available on a running system.
mode [-w file] [mode]
Set address translation of arguments to virtual (v) or
physical (p) mode. If no mode argument is given, the
current mode is printed. At the start of a crash ses-
sion, the mode is virtual.
mount [-e] [-w file] [[-p]table_entry...]
Alias: m, vfs.
Print information about mounted file systems.
nm [-w file] symbol ...
Print value and type for the given symbol.
nvram [-w file] type
Print information from non-volatile RAM. type may be
fwnvr for firmware nvram, unxnvr for UNIX nvram,
systate for system state nvram, or errlog for nvram
error log information.
[count]
od [-p] [-w file] [-format] [-mode] [-s process] start_addr
Alias: rd.
Print count values starting at start_addr in one of the
following formats: character (-c), decimal (-d), hexa-
decimal (-x), octal (-o), ASCII (-a), or
hexadecimal/character (-h), and one of the following
modes: long (-l), short (-t), or byte (-b). The
default mode for character and ASCII formats is byte;
the default mode for decimal, hexadecimal, and octal
formats is long. The format -h prints both hexadecimal
and character representations of the addresses dumped;
no mode needs to be specified. When format or mode is
omitted, the previous value is used. At the start of a
crash session, the format is hexadecimal and the mode
is long. If no count is entered, 1 is assumed.
page [-e] [-wfile] [[-p] table_entry ...]
Print information about pages.
pcb [-w file] [-u] [process]
pcb [-w file] [-k] [process]
pcb [-w file] [[-p]-i start_addr]
Print the process control block. If no arguments are
given, the active pcb for the current process is
printed. The user option (-u) prints the user pcb and
Last change: System Administration Utilities 6
crash(1M) MISC. REFERENCE MANUAL PAGES crash(1M)
the kernel option (-k) prints the kernel pcb associated
with the process. The interrupt option (-i) prints the
interrupt pcb located at start_addr.
prnode [-e] [-w file] [[-p] table_entry...]
Print information about the private data of processes
being traced.
proc [-e] [-f] [-w file] [[-p] table_entry ... #procid ...]
proc [-f] [-w file] [-r]
Alias: p.
Print the process table. Process table information may
be specified in two ways. First, any mixture of table
entries and process IDs may be entered. Each process ID
must be preceded by a #. Alternatively, process table
information for runnable processes may be specified
with the runnable option (-r).
ptbl [-w file] [-sprocess] section segment [count]
ptbl [-w file] [-sprocess] [-p] addr [count]
Print information on page descriptor tables.
pty [-f] [-e] [-w file] [-s] [-h] [-l]
Print the pseudo ttys presently configured. The -l, -h
and -h options give information about the STREAMS
modules ldterm, ptem and pckt, respectively.
qrun [-w file]
Print the list of scheduled streams queues.
queue [-e] [-w file] [[-p]table_entry...]
Print streams queues.
quit Alias: q.
Terminate the crash session.
rcvd [-e] [-f] [-w file] [[-p]table_entry...]
Print the receive descriptor table.
rduser [-e] [-f] [-w file] [[-p]table_entry...]
Print the receive descriptor user table.
redirect [-w file] [-c]
redirect [-w file] [newfile]
Used with a file name, redirects output of a crash ses-
sion to newfile. If no argument is given, the file
name to which output is being redirected is printed.
Alternatively, the close option (-c) closes the previ-
ously set file and redirects output to the standard
Last change: System Administration Utilities 7
crash(1M) MISC. REFERENCE MANUAL PAGES crash(1M)
output.
resource [-e] [-w file] [[-p]table_entry...]
Print the advertise table.
rtdptbl [-w file] [table_entry...]
Print the real-time scheduler parameter table. See
rtdptbl(4).
rtproc [-w file]
Print information about processes in the real-time
scheduler class.
sdt [-e] [-w file] [-s process] section
sdt [-e] [-w file] [-s process] [-p] start_addr [count]
The segment descriptor table for the named memory sec-
tion is printed. Alternatively, the segment descriptor
table starting at start_addr for count entries is
printed. If no count is given, a count of 1 is
assumed.
length
search [-p] [-w file] [-m mask] [-s process] pattern start_addr
Print the words in memory that match pattern, beginning
at the start_addr for length words. The mask is ANDed
(&) with each memory word and the result compared
against the pattern. The mask defaults to 0xffffffff.
size [-w file] [-x] [structure_name ... ]
Print the size of the designated structure. The (-x)
option prints the size in hexadecimal. If no argument
is given, a list of the structure names for which sizes
are available is printed.
sndd [-e] [-f] [-w file] [[-p]table_entry...]
Print the send descriptor table.
snode [-e] [-f] [-w file] [[-p]table_entry...]
Print information about open special files.
sram [-w file]
Alias: srams
Print the MMU segment table values.
srmount [-e] [-w file] [[-p]table_entry...]
Print the server mount table.
stack [-w file] [-u] [process]
stack [-w file] [-k] [process]
Last change: System Administration Utilities 8
crash(1M) MISC. REFERENCE MANUAL PAGES crash(1M)
stack [-w file] [[-p]-i start_addr]
Alias: s.
Dump the stack. The (-u) option prints the user stack.
The (-k) option prints the kernel stack. The (-i)
option prints the interrupt stack starting at
start_addr. If no arguments are entered, the kernel
stack for the current process is printed. The inter-
rupt stack and the stack for the current process are
not available on a running system.
stat [-w file]
Print system statistics.
stream [-e] [-f] [-w file] [[-p]table_entry...]
Print the streams table.
strstat [-w file]
Print streams statistics.
trace [-w file] [-r] [process]
trace [-w file] [[-p]-istart_addr]
Alias: t.
Print stack trace. The kfp value is used with the -r
option; the kfp function prints or sets the kfp (kernel
frame pointer) value. The interrupt option prints a
trace of the interrupt stack beginning at start_addr.
The interrupt stack trace and the stack trace for the
current process are not available on a running system.
ts [-w file] virtual_address ...
Print text symbol closest to the designated address.
tsdptbl [-w file] [table_entry...]
Print the time-sharing scheduler parameter table. See
tsdptbl(4).
tsproc [-w file]
Print information about processes in the time-sharing
scheduler class.
tty [-e] [-f] [-l] [-w file] [-ttype[[-p]table_entry...]]
tty [-e] [-f] [-l] [-w file] [[-p]start_addr]
Valid types: pp, iu.
Print the tty table. If no arguments are given, the tty
table for both tty types is printed. If the -t option
is used, the table for the single tty type specified is
printed. If no argument follows the type option, all
entries in the table are printed. A single tty entry
may be specified using start_addr. The -l option
prints the line discipline information.
Last change: System Administration Utilities 9
crash(1M) MISC. REFERENCE MANUAL PAGES crash(1M)
uinode [-e] [-f] [-w file] [[-p]table_entry...]
Alias: ui.
Print the ufs inode table.
user [-f] [-w file] [process]
Alias: u.
Print the ublock for the designated process.
var [-w file]
Alias: v.
Print the tunable system parameters.
vfs [-e] [-w file] [[-p]table_entry...]
Alias: mount, m.
Print information about mounted file systems.
vfssw [-w file] [[-p]table_entry...]
Print information about configured file system types.
vnode [-w file] [[-p]vnode_addr...]
Print information about vnodes.
vtop [-w file] [-s process] start_addr...
Print the physical address translation of the virtual
address start_addr.
FILES
/dev/mem system image of currently running system
/dev/ifdsk06 used to access system image on floppy
diskette
SEE ALSO
ldsysdump(1M), firmware(8).
Last change: System Administration Utilities 10