crash(1m)
_________________________________________________________________
crash
examine system images
_________________________________________________________________
SYNTAX
/etc/crash [-l log_file_name] [ memory_image_file ] [
system_image_file ]
DESCRIPTION
crash is an interactive utility that allows analysis of a system
image, dump, or a running system. It can display system
databases, look at logical memory, and perform miscellaneous
functions that are useful for inspecting a dump. The arguments
to crash are:
-l log_file_name This option causes crash to log all input and
output to the specified log_file_name.
memory_image_file The name of a file containing a system memory
image, either a memory dump obtained from a
system crash or the actual memory of a
running system.
system_image_file The name of a file containing the executable
system image used to produce the memory image
file; /dgux is the default.
The following table summarizes how these arguments are handled.
____________________________________________________________
| | Argument 1 | Argument 2 |
|____________________|_____________________|________________|
| Default | /dev/mem | /dgux |
|____________________|_____________________|________________|
| If argument 1 is a | Treated as a memory| System image |
| memory image file | image file derived | file |
| | from argument 2 or | |
| | the default | |
|____________________|_____________________|________________|
| If argument 1 is a | Treated as the | Ignored |
| system image file | memory image file | |
| | and the system | |
| | image file | |
|____________________|_____________________|________________|
DG/UX 4.00 Page 1
Licensed material--property of copyright holder(s)
crash(1m)
COMMANDS
Once crash has started, you enter a crash command line
interpreter. Crash has two sets of commands:
* DG/UX system specific commands.
These commands allow you to display internal DG/UX System
kernel information. The DG/UX system commands are:
eval Evaluate expressions
help Print help information
quit Exit crash
file Display file descriptor information
focus Look at the address space of a given process
inpcb Display the inpcb chain
pcb Display the current machine state for the process
ps Describe the process table
socket Display socket structure
tcppcb Display the tcppcb structure
trace Traceback a processes stack
tty Display terminal structures
user Display Per Process information
vnode Look at vnodes, inode and/or rnodes
vpsb Describe a VPSB
vtop Convert virtual to physical
* Debugger commands
These commands let you read a program's symbol
table or display its memory. In addition, there
are several expression evaluation commands that
let you compute the values of octal or hexadecimal
expressions. The debugger commands are:
do View down
DG/UX 4.00 Page 2
Licensed material--property of copyright holder(s)
crash(1m)
nm Print symbol table entry
od Display memory
os Memory search
ow View or modify memory
ts Translate an expression value to a symbol
up View up
ust Change the symbol table
vi View memory in code format
We discuss the specifics of each command below. However, in
general the syntax of crash commands is of the form:
command [ options ] [ structures to be printed ]
Each command must be on one line terminated by a newline,
carriage return, form-feed, or null character. Output is printed
to the screen. The prompt for crash is <>.
Crash supports a help facility that you invoke by typing help
followed by a newline.
TERMINOLOGY
The following terms are used in this document.
System image file
The DG/UX System bootable image, normally called dgux. This
image file contains the code for the system and the symbol
table. A system image is required to execute crash.
System dump
A system dump is a physical memory dump created by running
the system shutdown code.
Running system
A running system is a system in normal operation. Crash may
be used to analyze this system by reading physical memory
from /dev/mem.
Address translation
Address translation is the process of converting a logical
address to a physical address.
DG/UX 4.00 Page 3
Licensed material--property of copyright holder(s)
crash(1m)
Slot Number
Many structures are referenced by their index into an array.
This index is called a slot number. For example, processes
are referenced by their index into the process table, not
their process id.
VPSB A VPSB is a Virtual Processor State Block. A VPSB contains
the neccesary information to allow a process to run on a
processor. There are a limited number of VPSBs in a system.
DG/UX SYSTEM COMMANDS
The DG/UX system commands are described below. These commands
are divided into two subsystems: kernel commands and network
commands.
Kernel Commands
The filesystem commands allow the user to look at vnode, inode
and rnode structures. These structures are accessed by address
or by file descriptor and process index.
File: Display file descriptor information
The file command describes a file opened by a process. Files may
be referenced by object address or by process index and file
descriptor number. If an object address is given, that address
is assumed to point to an object structure. If a process index is
given with no file descriptor, then all the files opened by that
process are described. If a file descriptor is given along with
the process index, then the file opened on that file descriptor
is described.
You use the file command to display a user file descriptor. The
syntax for this command is as follows:
file [options] <process_index> [fd] | <object address>
Where :
<process_index> is the process table index.
[fd] is the file descriptor number
object_address is the address of an object structure.
The following options allow the user to limit the types of files
to be displayed:
DG/UX 4.00 Page 4
Licensed material--property of copyright holder(s)
crash(1m)
-p Only display this file descriptor if it is a pipe.
-s Only display this file descriptor if it is a socket.
-f Only display this file descriptor if it is a file.
-a Display the attributes area of the file descriptor.
Vnode: Look at vnodes, inode and/or rnodes
The vnode command describes vnodes, inodes and rnodes. The user
supplies the address of a vnode, rnode or inode. The command
will try to determine which type of structure the pointer points
to and describe it. The user may specify the type of the
structure. The syntax for this command is as follows:
vnode [options] [address]
The following options allow you to control command output:
-v Describe the structure if the address points to a vnode.
-i Describe the structure if the address points to a inode.
-r Describe the structure if the address points to a rnode.
Vtop: Convert virtual to physical
The vtop command converts the given virtual address to a physical
address and prints the result. The address space is assumed to be
the one currently bound.
Ps: Describe the process table
The ps command describes the process table entry for the
processes specified. A process may by selected by process index
or by process table address. The syntax for this command is as
follows:
ps [options] [process indexes | process table entry address]
The following options allow you to control command output:
-a Display a long description of the process table.
-p pid Display only if the process id matches pid.
-u uid Display only if the user id matches uid.
DG/UX 4.00 Page 5
Licensed material--property of copyright holder(s)
crash(1m)
-n name Display only if the process name matches name.
Vpsb: Describe a VPSB
The vpsb command displays the state of the specified vp state
block. If no vp_id is given, all of the vpsbs will be displayed.
The syntax for this command is as follows:
vpsb [vp_id]
Focus: Look at the address space of a given process
The focus command allows the user to look at the address space of
the given process. The process is selected by process index. This
allows the user to look at the per-process and user state of
that process. The syntax for this command is as follows:
focus [options] [process_index]
The following options allow you to control command output:
-v Use the process_index as a VPID.
Trace: Traceback a processes stack
The trace command will display a traceback of a process's kernel
and/or user stack. If a process index is not given, the currently
bound process will be traced. If a process index is given, that
process will be traced. The syntax for this command is as
follows:
trace [options] [process_index]
The following options allow you to control command output:
-a Display the arguments in the traceback.
-u Continue the traceback into the users address space.
-v Use the process_index as a VPID.
-faddr Start the traceback at the given address.
Pcb: Display the current machine state for the process
The pcb command displays the current machine state for the given
DG/UX 4.00 Page 6
Licensed material--property of copyright holder(s)
crash(1m)
process. The syntax for this command is as follows:
pcb [process_index]
User: Display Per Process information
The user command gathers per process information for a process
index and displays it a useful form. The syntax for this command
is as follows:
user [process_index]
Tty: Display terminal structures
The tty command displays the tty structures for the terminal
lines specified. A terminal line may be selected by terminal line
number or tty structure address. The syntax for this command is
as follows:
tty [options] [list of terminal numbers | tty address ]
The following options allow you to control command output:
-s Only display the terminal state from the tty structure.
-a Display an expanded version of the tty structure.
-t[type] Change the default type from IAC to [type].
Stat: Display DG/UX system information
The stat command displays useful information about the DG/UX
system. The syntax for this command is as follows:
stat
Networking Commands
You can use these network commands to display information in
network specific structures such as socket structures and TCP/IP
structures.
Socket: Display socket structure
The socket command displays the DG/UX system socket structure
pointed to by the socket address. The syntax for this command is
DG/UX 4.00 Page 7
Licensed material--property of copyright holder(s)
crash(1m)
as follows:
socket [socket_address]
Tcppcb: Display the tcppcb structure
The tcppcb command displays the DG/UX system tcppcb structure
pointed to by the pcb block address. The aliases are tcpcb and
tcp. The syntax for this command is as follows:
tcppcb [pcb_block_address]
Inpcb: Display the inpcb chain
The inpcb command displays the inpcb chain structure. The syntax
for this command is as follows:
inpcb [inpcb_chain_address]
DEBUGGER COMMANDS
The debugger commands allow you to display symbol table data and
program memory.
Debugger Memory Commands:
Within the crash debugger commands, All memory commands have a
common format. Rather than restate this format for each command,
we describe it below. (Note: This is the general format.
Defaults and arguments definitions may differ between commands.
See each command for details.) The format is:
command [options] [memory_address] [count] [format]
command Specifiy the name of the command to be used.
[options] Options are given after the command name and
are preceded with a dash.
[memory_address] The memory address is the starting address to
be examined. The memory_address is given as an
expression. This argument is optional. If not
given, the default is the current view_pc.
[count] The count argument determines how many elements
are to be operated on. This argument is
DG/UX 4.00 Page 8
Licensed material--property of copyright holder(s)
crash(1m)
optional. If not given, the default is
determined by the command itself.
[format] The format argument describes the format of the
elements to be examined. This argument is
optional. If not given, the default is
determined by the command itself.
The options for the memory commands must be preceded with a dash.
Multiple options may be grouped into one string with a preceding
dash. The memory command options are:
b The b option specifies that the memory address is
really a byte address and not a word address.
p The p option specifies that the memory address is a
physical address, not a logical address. This means
the read or write physical routine will be call
directly to read or write data.
v The v option is the verify option for the octal write
command. See the octal write command for more
information.
n The n options turns off converting labels to there
symbolic form during printing memory locations.
Formats The formats supported for the memory commands are
described below.
decimal The memory location is a 16 bit decimal value.
Aliases for decimal are [dec, d].
octal The memory location is a 16 bit octal value. Aliases
for octal are [oct, o].
character The memory location is an 8 bit character value.
Aliases for character are [char, c].
instruction The memory location is the start of an instruction.
Aliases for instruction are [ i ].
byte The memory location is an 8 bit octal value. Aliases
for byte are [ b ].
longdec The memory location is a 32 bit decimal value.
Aliases for decimal are [ ld ].
longoct The memory location is a 32 bit octal value. Aliases
for octal are [ lo ].
DG/UX 4.00 Page 9
Licensed material--property of copyright holder(s)
crash(1m)
hexadecimal The memory location is a 32 bit hex value. Aliases
for octal are [ h, x, hex ].
ssym The memory location is a 16 bit symbolic value. There
are no other aliases.
sym The memory location is a 32 bit symbolic value. There
are no other aliases.
string The memory location is the start of a string,
terminated by a null. Aliases for string are [ s ].
pte The memory location is a page table entry. There are
no other aliases.
def If no format is specified, the default format is
used. Each memory command has its own real default
format.
The memory reference commands are listed below.
Od: Display memory dump
The od command displays memory starting at the memory address, in
the given format, for the specified number of elements. The
number of elements displayed per line depends on the format
selected. The current memory address is displayed at the
beginning of the line. The default format is longoct and the
default count is 1.
Ow: View or modify memory
The ow command allows the user to both view and modify memory
locations one at a time. The modification starts are the memory
address. It will continue until either count elements have been
displayed or a q has been entered. Memory elements must be
modified in the format specified. The default format is longoct
and the default count is infinite.
Octal write displays the element at the memory address, in the
format specified followed by a right bracket (>). You may then
enter a response to that value. The valid responses are listed
below.
q Exit octal write.
^ Leave this location untouched, but display for
modification, the previous element.
DG/UX 4.00 Page 10
Licensed material--property of copyright holder(s)
crash(1m)
NL,CR Leave this location untouched, but display for
modification, the next element.
Expression
Resolve the expression, expecting the format specified
and write the results into the memory location. If the
verify flag is set, redisplay this element again,
otherwise display the next element for modification.
In short, you are allowed to scan through memory modifying it
selectively. Please note that modifying instructions is allowed,
but this may effect the content of the next instruction.
Os: Memory search
The os command searches through memory for a given value in a
given format. The search starts at memory address and continues
for a maximum of count elements. The default count is infinite
and the default format is longoct. You will be prompted for the
search value. You must enter the search value in the format
specified. If a value matching the search value is found, a view
(see view command) is performed at the location where the match
occurred.
Vi: View memory in code format
The vi command is similar to the octal dump command, but it
displays elements in a different format. The view command is used
to display the element at the memory address surrounded by six
elements on either side of the memory address. This is useful
when looking at code in instruction mode and wanting to see the
neighboring instructions. The default format is instruction mode.
The count argument is not used and may be ignored. The default
memory address is the view_pc. If a memory_address is given to
the view command, that memory address becomes the new view_pc.
Do: view down
The do (view down) command increments the view_pc such that
sequential executions of this command will produce a continuous
listing of elements.
down
Up: view up
The up (view up) command decrements the view_pc such that
sequential executions of this command will produce a continuous
DG/UX 4.00 Page 11
Licensed material--property of copyright holder(s)
crash(1m)
listing of elements.
up
Nm: Print symbol table entry
The nm command searches the symbol table for a match to the
regular expression given. If a match is found, the symbol is
printed along with its value and symbol type. The syntax for
this command is as follows:
nm [regular_expression]
Ts: Translate an expression value to a symbol
The ts command evaluates the expression given and converts it to
a symbolic value using the current set of symbol tables. If a
relevant symbol cannot be found, the value is converted to an
octal string. The resulting string is then printed. The syntax
for this command is as follows:
ts [expression]
Ust: Change the symbol table
The ust command allows you to redefine the current symbol table.
Filename is the name of a program image containing a symbol
table. The syntax for this command is as follows:
ust filename
Help
The help command prints help information about a command. If the
help command is invoked with no arguments, then the list of
supported commands is printed separated by subsystem. If a
command name is given, the help string associated with that
command is printed. The syntax for this command is as follows:
help [command_name]
Quit: Exit crash
DG/UX 4.00 Page 12
Licensed material--property of copyright holder(s)
crash(1m)
The quit command is used to exit the program. This command will
call the exit(2) system call with a 0 status code. The syntax
for this command is as follows:
quit
Eval: Evaluate expressions
The eval command evaluates the expression given and prints the
result in octal, decimal and symbol formats. The syntax for this
command is as follows:
eval [expression]
The rest of this section describes valid expressions. An
expression may not contain any white space. The expression is an
arithmetic expression that results in one value. The elements of
the expression are symbols, integers, the value of memory
locations, binary operators and unary operators. Parenthesis may
be used any time.
The binary operators perform an operation on two values. For
example v1 op v2. The valid binary operators are:
+ Add v1 and v2.
- Subtract v2 from v1.
* Multiply v1 and v2.
/ Divide v1 with v2.
& Logical and v1 and v2.
| Logical or v1 and v2.
> 1 if v1 > v2 and 0 if v1 <= v2.
< 1 if v1 < v2 and 0 if v1 >= v2.
= 1 if v1 = v2 and 0 if v1 != v2.
The unary operators perform an operation on a single value. For
example op v1. The valid unary operators are:
# Read the 32 bit value at the address v1.
@ Read the 16 bit value at the address v1.
DG/UX 4.00 Page 13
Licensed material--property of copyright holder(s)
crash(1m)
The values used in the expression come from:
Symbol table values.
Integers.
Expression evaluations.
Addresses
For the MV architecture, an address may be abbreviated as
<word offset in ring>;<ring number>
For Example:
016000002345 = 2345;7 ring 7 address
002000002345 = 2345;1 ring 1 address
FILES
/usr/include/rpc/.h
Header file for table and structure information
/usr/include/sys/.h
Header file for table and structure information
/dev/mem
Default system image file
/dgux
Default namelist file
SEE ALSO
mount(1M), ps(1), sh(1), stty(1).
DG/UX 4.00 Page 14
Licensed material--property of copyright holder(s)