crash(1M) UNIX System V(System Administration Utilities) crash(1M)
NAME
crash - examine system images
SYNOPSIS
/usr/sbin/crash [ -d dumpfile ] [ -n namelist ] [ -w outputfile ]
DESCRIPTION
The crash command is used to examine the system memory image of a running
or a crashed system by formatting and printing control structures,
tables, and other information. Command line arguments to crash are
dumpfile, namelist, and outputfile.
dumpfile is the file containing the system memory image. The default
dumpfile is /dev/mem.
The text file namelist contains the symbol table information needed for
symbolic access to the system memory image to be examined. The default
namelist is /stand/unix. If a system image from another machine is to be
examined, the corresponding text file must be copied from that machine.
When the crash command is invoked, a session is initiated. The output
from a crash session is directed to outputfile. The default outputfile
is the standard output.
Input during a crash session is of the form:
function [ argument... ]
where function is one of the crash functions described in the
``FUNCTIONS'' subsection of this manual page, and arguments are
qualifying data that indicate which items of the system image are to be
printed.
The default for process-related items is the current process for a
running system or the process that was running at the time of the crash
for a crashed system. If the contents of a table are being dumped, the
default is all active table entries.
The following function options are available to crash functions wherever
they are semantically valid.
-e Display every entry in a table.
-f Display the full structure.
-p Interpret all address arguments in the command line as physical
addresses. If they are not physical addresses, results are
inconsistent.
-s process
Specify a process slot other than the default.
10/89 Page 1
crash(1M) UNIX System V(System Administration Utilities) crash(1M)
-w file Redirect the output of a function to file.
The functions mode, defproc, and redirect correspond to the function
options -p, -s, and -w. The mode function may be used to set the address
translation mode to physical or virtual for all subsequently entered
functions; defproc sets the value of the process slot argument for
subsequent functions; and redirect redirects all subsequent output.
Output from crash functions may be piped to another program in the
following way:
function [ argument... ] ! shell_command
For example,
mount ! grep rw
writes all mount table entries with an rw flag to the standard output.
The redirection option (-w) cannot be used with this feature.
Depending on the context of the function, numeric arguments are assumed
to be in a specific radix. Counts are assumed to be decimal. Addresses
are always hexadecimal. Table slot arguments larger than the size of the
function will not be interpreted correctly. Use the findslot command to
translate from an address to a table slot number. Default bases on all
arguments may be overridden. The C conventions for designating the bases
of numbers are recognized. A number that is usually interpreted as
decimal is interpreted as hexadecimal if it is preceded by 0x and as
octal if it is preceded by 0. Decimal override is designated by 0d, and
binary by 0b.
Aliases for functions may be any uniquely identifiable initial substring
of the function name. Traditional aliases of one letter, such as p for
proc, remain valid.
Many functions accept different forms of entry for the same argument.
Requests for table information will accept a table entry number or a
range. A range of slot numbers may be specified in the form a-b where a
and b are decimal numbers. An expression consists of two operands and an
operator. An operand may be an address, a symbol, or a number; the
operator may be +, -, *, /, &, or | . An operand that is a number should
be preceded by a radix prefix if it is not a decimal number (0 for octal,
0x for hexadecimal, 0b for binary). The expression must be enclosed in
parentheses. Other functions accept any of these argument forms that are
meaningful.
Two abbreviated arguments to crash functions are used throughout. Both
accept data entered in several forms. They may be expanded into the
following:
Page 2 10/89
crash(1M) UNIX System V(System Administration Utilities) crash(1M)
table_entry = address | slot | range
start_addr = address | symbol | expression
FUNCTIONS
? [-w file]
List available functions.
!command
Escape to the shell and execute command.
as [-e] [-f] [-w file] [proc...]
Print information on process segments.
base [-w file] number ...
Print number in binary, octal, decimal, and hexadecimal. A number
in a radix other than decimal should be preceded by a prefix that
indicates its radix as follows: 0x, hexadecimal; 0, octal; and 0b,
binary.
buffer [-w file] [-format] bufferslot
buffer [-w file] [-format] [-p]start_addr
Alias: b.
Print the contents of a buffer in the designated format. The
following format designations are recognized: -b, byte: -c,
character; -d, decimal; -x, hexadecimal; -o, octal; and, -i, inode.
If no format is given, the previous format is used. The default
format at the beginning of a crash session is hexadecimal.
bufhdr [-f] [-w file] [[-p]table_entry...]
Alias: buf.
Print system buffer headers. The -f option produces different
output depending on whether the buffer is local or remote (contains
RFS data).
callout [-w file]
Alias: c.
Print the callout table.
class [-w file] [table_entry...]
Print information about process scheduler classes.
dbfree [-w file] [class ... ]
Print free streams data block headers. If a class is entered, only
data block headers for the class specified is printed.
dblock [-e] [-w file] [-c class...]
dblock [-e] [-w file] [[-p] table_entry...]
Print allocated streams data block headers. If the class option
(-c) is used, only data block headers for the class specified is
10/89 Page 3
crash(1M) UNIX System V(System Administration Utilities) crash(1M)
printed.
defproc [-w file] [-c]
defproc [-w file] [slot]
Set the value of the default process slot argument. The default
process slot argument may be set to the current slot number (-c) or
the slot number may be specified. If no argument is entered, the
value of the previously set slot number is printed. At the start
of a crash session, the process slot is set to the current process.
dis [-w file] [-a] start_addr [count]
dis [-w file] [-a] -c [count]
Disassemble count instructions starting at start_addr. The default
count is 1. The absolute option (-a) specifies a non-symbolic
disassembly. The -c option can be used in place of start_addr to
continue disassembly at the address at which a previous disassembly
ended.
dispq [-w file] [table_entry...]
Print the dispatcher (scheduler) queues.
ds [-w file] virtual_address ...
Print the data symbol whose address is closest to, but not greater
than, the address entered.
file [-e] [-w file] [[-p]table_entry...]
Alias: f.
Print the file table.
findaddr [-w file] table slot
Print the address of slot in table. Only tables available to the
size function are available to findaddr.
findslot [-w file] virtual_address ...
Print the table, entry slot number, and offset for the address
entered. Only tables available to the size function are available
to findslot.
fs [-w file] [[-p]table_entry...]
Print the file system information table.
gdp [-e] [-f] [-w file] [[-p]table_entry...]
Print the gift descriptor protocol table.
gdt [-e] [-w file] [slot[count]]
table_entry...] Print the global descriptor table.
help [-w file] function ...
Print a description of the named function, including syntax and
aliases.
Page 4 10/89
crash(1M) UNIX System V(System Administration Utilities) crash(1M)
idt [-e] [-w file] [slot[count]]
Print the interrupt descriptor table.
inode [-e] [-f] [-w file] [[-p]table_entry...]
Alias: i.
Print the inode table, including file system switch information.
kfp [-w file] [value...]
Print the kernel frame pointer (kfp) for the start of a kernel
stack trace. If the value argument is supplied, the p is set to
that value. If no argument is entered, the current value of the
kfp is printed.
kmastat [-w file]
Print kernel memory allocator statistics.
lck [-e] [-w file] [[-p]table_entry...]
Alias: l.
Print record locking information. If the -e option is used or table
address arguments are given, the record lock list is printed. If
no argument is entered, information on locks relative to inodes is
printed.
ldt [-e] [-w file] [process[slot[count]]]
Print the local descriptor table for the given process, for the
current process if none is given.
linkblk [-e] [-w file] [[-p]table_entry...]
Print the linkblk table.
map [-w file] mapname ...
Print the map structure of the given mapname.
mbfree [-w file]
Print free streams message block headers.
mblock [-e] [-w file] [[-p]table_entry...]
Print allocated streams message block headers.
mode [-w file] [mode]
Set address translation of arguments to virtual (v) or physical (p)
mode. If no mode argument is given, the current mode is printed.
At the start of a crash session, the mode is virtual.
mount [-e] [-w file] [[-p]table_entry...]
Alias: m, vfs.
Print information about mounted file systems.
nm [-w file] symbol ...
Print value and type for the given symbol.
10/89 Page 5
crash(1M) UNIX System V(System Administration Utilities) crash(1M)
od [-p] [-w file] [-format] [-mode] [-s process] start_addr [count]
Alias: rd.
Print count values starting at start_addr in one of the following
formats: character (-c), decimal (-d), hexadecimal (-x), octal
(-o), ASCII (-a), or hexadecimal/character (-h), and one of the
following modes: long (-l), short (-t), or byte (-b). The default
mode for character and ASCII formats is byte; the default mode for
decimal, hexadecimal, and octal formats is long. The format -h
prints both hexadecimal and character representations of the
addresses dumped; no mode needs to be specified. When format or
mode is omitted, the previous value is used. At the start of a
crash session, the format is hexadecimal and the mode is long. If
no count is entered, 1 is assumed.
panic Print the latest system notices, warnings, and panic messages from
the limited circular buffer kept in memory.
page [-e] [-wfile] [[-p] table_entry ...]
Print information about pages.
pcb [-w file] [process]
Print the process control block (TSS). If no arguments are given,
the active TSS for the current process is printed.
prnode [-e] [-w file] [[-p] table_entry...]
Print information about the private data of processes being traced.
proc [-e] [-f] [-w file] [[-p] table_entry ... #procid ...]
proc [-f] [-w file] [-r]
Alias: p.
Print the process table. Process table information may be specified
in two ways. First, any mixture of table entries and process IDs
may be entered. Each process ID must be preceded by a #.
Alternatively, process table information for runnable processes may
be specified with the runnable option (-r). The full option (-f)
details most of the information in the process table as well as the
region for that process.
ptbl [-e] [-w file] [-sprocess] [[-p] addr [count] ]
Print information on page descriptor tables.
pty [-f] [-e] [-w file] [-s] [-h] [-l]
Print the pseudo ttys presently configured. The -l, -h and -h
options give information about the STREAMS modules ldterm, ptem and
pckt, respectively.
qrun [-w file]
Print the list of scheduled streams queues.
Page 6 10/89
crash(1M) UNIX System V(System Administration Utilities) crash(1M)
queue [-e] [-w file] [[-p]table_entry...]
Print streams queues.
quit Alias: q.
Terminate the crash session.
rcvd [-e] [-f] [-w file] [[-p]table_entry...]
Print the receive descriptor table.
rduser [-e] [-f] [-w file] [[-p]table_entry...]
Print the receive descriptor user table.
redirect [-w file] [-c]
redirect [-w file] [newfile]
Used with a file name, redirects output of a crash session to
newfile. If no argument is given, the file name to which output is
being redirected is printed. Alternatively, the close option (-c)
closes the previously set file and redirects output to the standard
output.
resource [-e] [-w file] [[-p]table_entry...]
Print the advertise table.
rtdptbl [-w file] [table_entry...]
Print the real-time scheduler parameter table. See rtdptbl(4).
rtproc [-w file]
Print information about processes in the real-time scheduler class.
search [-p] [-w file] [-m mask] [-s process] pattern start_addr length
Print the long words in memory that match pattern, beginning at the
start_addr for length long words. The mask is ANDed (&) with each
memory word and the result compared against the pattern. The mask
defaults to 0xffffffff.
size [-w file] [-x] [structure_name ... ]
Print the size of the designated structure. The (-x) option prints
the size in hexadecimal. If no argument is given, a list of the
structure names for which sizes are available is printed.
sndd [-e] [-f] [-w file] [[-p]table_entry...]
Print the send descriptor table.
snode [-e] [-f] [-w file] [[-p]table_entry...]
Print information about open special files.
srmount [-e] [-w file] [[-p]table_entry...]
Print the server mount table.
10/89 Page 7
crash(1M) UNIX System V(System Administration Utilities) crash(1M)
stack [-w file] [process]
Alias: s.
Dump the stack. If no arguments are entered, the kernel stack for
the current process is printed. The interrupt stack and the stack
for the current process are not available on a running system.
stat [-w file]
Print system statistics.
stream [-e] [-f] [-w file] [[-p]table_entry...]
Print the streams table.
strstat [-w file]
Print streams statistics.
trace [-w file] [-r] [process]
Alias: t.
Print stack trace. The kfp value is used with the -r option; the
kfp function prints or sets the kfp (kernel frame pointer) value.
ts [-w file] virtual_address ...
Print text symbol closest to the designated address.
tsdptbl [-w file] [table_entry...]
Print the time-sharing scheduler parameter table. See tsdptbl(4).
tsproc [-w file]
Print information about processes in the time-sharing scheduler
class.
tty [-e] [-f] [-l] [-w file] [-ttype[[-p]table_entry...] | [-p] start addr]
Valid types: kd, asy, console, comports.
Print the tty table. If no arguments are given, the tty table for
both tty types is printed. If the -t option is used, the table for
the single tty type specified is printed. If no argument follows
the type option, all entries in the table are printed. A single
tty entry may be specified using start_addr. The -l option prints
the line discipline information.
uinode [-e] [-f] [-w file] [[-p]table_entry...]
Alias: ui.
Print the ufs inode table.
user [-f] [-w file] [process]
Alias: u.
Print the ublock for the designated process.
var [-w file]
Alias: v.
Print the tunable system parameters.
Page 8 10/89
crash(1M) UNIX System V(System Administration Utilities) crash(1M)
vfs [-e] [-w file] [[-p]table_entry...]
Alias: mount, m.
Print information about mounted file systems.
vfssw [-w file] [[-p]table_entry...]
Print information about configured file system types.
vnode [-w file] [[-p]vnode_addr...]
Print information about vnodes.
vtop [-w file] [-s process] start_addr...
Print the physical address translation of the virtual address
start_addr.
10/89 Page 9