CRASH(1M) (System Administration Utilities) CRASH(1M)
NAME
crash - examine system images
SYNOPSIS
/etc/crash [ -d dumpfile ] [ -n namelist ] [ -w
outputfile ]
DESCRIPTION
The crash command is used to examine the system memory image
of a live or a crashed system by formatting and printing
control structures, tables, and other information. Command
line arguments to crash are dumpfile, namelist, and
outputfile.
Dumpfile is the file containing the system memory image.
The default dumpfile is /dev/kmem.
The text file namelist contains the symbol table information
needed for symbolic access to the system memory image to be
examined. The default namelist is /unix. If a system image
from another machine is to be examined, the corresponding
text file must be copied from that machine.
When the crash command is invoked, a session is initiated.
The output from a crash session is directed to outputfile.
The default outputfile is the standard output.
Input during a crash session is of the form:
function [argument ... ]
where function is one of the crash functions described in
the FUNCTIONS section of this manual page, and arguments are
qualifying data that indicate which items of the system
image are to be printed.
The default for process-related items is the current process
for a running system and the process that was running at the
time of the crash for a crashed system. If the contents of
a table are being dumped, the default is all active table
Page 1 May 1989
CRASH(1M) (System Administration Utilities) CRASH(1M)
entries.
The following function options are available to crash
functions wherever they are semantically valid.
-e Display every entry in a table.
-f Display the full structure.
-p Interpret all address arguments in the command line as
physical addresses.
-s process
Specify a process slot other than the default.
-w file
Redirect the output of a function to file.
Note that if the -p option is used, all address and symbol
arguments explicitly entered on the command line will be
interpreted as physical addresses. If they are not physical
addresses, results will be inconsistent.
The functions mode, defproc, and redirect correspond to the
function options -p, -s, and -w. The mode function may be
used to set the address translation mode to physical or
virtual for all subsequently entered functions; defproc sets
the value of the process slot argument for subsequent
functions; and redirect redirects all subsequent output.
Output from crash functions may be piped to another program
in the following way:
function [argument ... ]!shell_command
For example,
mount ! grep rw
will write all mount table entries with an rw flag to the
Page 2 May 1989
CRASH(1M) (System Administration Utilities) CRASH(1M)
standard output. The redirection option (-w) cannot be used
with this feature.
Depending on the context of the function, numeric arguments
will be assumed to be in a specific radix. Counts are
assumed to be decimal. Addresses are always hexadecimal.
Table address arguments larger than the size of the function
table will be interpreted as hexadecimal addresses; those
smaller will be assumed to be decimal slots in the table.
Default bases on all arguments may be overridden. The C
conventions for designating the bases of numbers are
recognized. A number that is usually interpreted as decimal
will be interpreted as hexadecimal if it is preceded by 0x
and as octal if it is preceded by 0. Decimal override is
designated by 0d, and binary by 0b.
Aliases for functions may be any uniquely identifiable
initial substring of the function name. Traditional aliases
of one letter, such as p for proc, remain valid.
Many functions accept different forms of entry for the same
argument. Requests for table information will accept a
table entry number, a physical address, a virtual address, a
symbol, a range, or an expression. A range of slot numbers
may be specified in the form a-b where a and b are decimal
numbers. An expression consists of two operands and an
operator. An operand may be an address, a symbol, or a
number; the operator may be +, -, *, /, &, or | . An
operand which is a number should be preceded by a radix
prefix if it is not a decimal number (0 for octal, 0x for
hexidecimal, 0b for binary). The expression must be
enclosed in parentheses (). Other functions will accept any
of these argument forms that are meaningful.
Two abbreviated arguments to crash functions are used
throughout. Both accept data entered in several forms.
They may be expanded into the following:
table_entry = table entry| address| symbol| range|
expression
Page 3 May 1989
CRASH(1M) (System Administration Utilities) CRASH(1M)
start_addr = address| symbol| expression
FUNCTIONS
? [-w file] List available functions.
!cmd Escape to the shell to execute a command.
adv [-e] [-w file] [[-p]table_entry...]
Print the advertise table.
base [-w file] number ...
Print number in binary, octal, decimal, and
hexadecimal. A number in a radix other then decimal
should be preceded by a prefix that indicates its radix
as follows: 0x, hexidecimal; 0, octal; and 0b, binary.
buffer [-w file] [-format] bufferslot
or
buffer [-w file] [-format] [-p]start_addr
Alias: b.
Print the contents of a buffer in the designated
format. The following format designations are
recognized: -b, byte: -c, character; -d, decimal; -x,
hexadecimal; -o, octal; -r, directory; and -i, inode.
If no format is given, the previous format is used.
The default format at the beginning of a crash session
is hexadecimal.
bufhdr [-f] [-w file] [[-p]table_entry...]
Alias: buf.
Print system buffer headers.
The -f option produces different output depending on
whether the buffer is local or remote (contains RFS
data).
callout [-w file]
Alias: c.
Print the callout table.
Page 4 May 1989
CRASH(1M) (System Administration Utilities) CRASH(1M)
dballoc [-w file] [class ... ]
Print the dballoc table. If a class is entered, only
data block allocation information for that class will
be printed.
dbfree [-w file] [class ... ]
Print free streams data block headers. If a class is
entered, only data block headers for the class
specified will be printed.
dblock [-e] [-w file] [-c class...]
or
dblock [-e] [-w file] [[-p] table_entry...]
Print allocated streams data block headers. If the
class option (-c) is used, only data block headers for
the class specified will be printed.
defproc [-w file] [-c]
or
defproc [-w file] [slot]
Set the value of the process slot argument. The
process slot argument may be set to the current slot
number (-c) or the slot number may be specified. If no
argument is entered, the value of the previously set
slot number is printed. At the start of a crash
session, the process slot is set to the current
process.
ds [-w file] virtual_address ...
Print the data symbol whose address is closest to, but
not greater than, the address entered.
file [-e] [-w file] [[-p]table_entry...]
Alias: f.
Print the file table.
Page 5 May 1989
CRASH(1M) (System Administration Utilities) CRASH(1M)
findaddr [-w file] table slot
Print the address of slot in table. Only tables
available to the size function are available to
findaddr.
findslot [-w file] virtual_address ...
Print the table, entry slot number, and offset for the
address entered. Only tables available to the size
function are available to findslot.
fs [-w file] [[-p]table_entry...]
Print the file system information table.
gdp [-e] [-f] [-w file] [[-p]table_entry...]
Print the gift descriptor protocol table.
help [-w file] function ...
Print a description of the named function, including
syntax and aliases.
inode [-e] [-f] [-w file] [[-p]table_entry...]
Alias: i.
Print the inode table, including file system switch
information.
lck [-e] [-w file] [[-p]table_entry...]
Alias: l.
Print record locking information. If the -e option is
used or table address arguments are given, the record
lock list is printed. If no argument is entered,
information on locks relative to inodes is printed.
linkblk [-e] [-w file] [[-p]table_entry...]
Print the linkblk table.
major [-w file] [entry ...]
Print the MAJOR table.
map [-w file] mapname ...
Print the map structure of the given mapname.
Page 6 May 1989
CRASH(1M) (System Administration Utilities) CRASH(1M)
mbfree [-w file]
Print free streams message block headers.
mblock [-e] [-w filename] [[-p]table_entry...]
Print allocated streams message block headers.
mode [-w file] [mode]
Set address translation of arguments to virtual (v) or
physical (p) mode. If no mode argument is given, the
current mode is printed. At the start of a crash
session, the mode is virtual.
mount [-e] [-w file] [[-p]table_entry...]
Alias: m.
Print the mount table.
nm [-w file] symbol ...
Print value and type for the given symbol.
[count]
od [-p] [-w file] [-format] [-mode] [-s process] start_addr
Alias: rd.
Print count values starting at the start address in one
of the following formats: character (-c), decimal
(-d), hexadecimal (-x), octal (-o), ascii (-a), or
hexadecimal/character (-h), and one of the following
modes: long (-l), short (-t), or byte (-b). The
default mode for character and ascii formats is byte;
the default mode for decimal, hexadecimal, and octal
formats is long. The format -h prints both hexadecimal
and character representations of the addresses dumped;
no mode needs to be specified. When format or mode is
omitted, the previous value is used. At the start of a
crash session, the format is hexadecimal and the mode
is long. If no count is entered, 1 is assumed.
pfdat [-e] [-w file] [[-p]table_entry...]
Print the pfdata table.
proc [-e] [-f] [-w file] [[-p] table_entry ... #procid ...]
Page 7 May 1989
CRASH(1M) (System Administration Utilities) CRASH(1M)
or
proc [-f] [-w file] [-r]
Alias: p.
Print the process table. Process table information may
be specified in two ways. First, any mixture of table
entries and process ids may be entered. Each process id
must be preceded by a #. Alternatively, process table
information for runnable processes may be specified
with the runnable option (-r).
qrun [-w file]
Print the list of scheduled streams queues.
queue [-e] [-w file] [[-p]table_entry...]
Print streams queues.
quit Alias: q.
Terminate the crash session.
rcvd [-e] [-f] [-w file] [[-p]table_entry...]
Print the receive descriptor table.
redirect [-w file] [-c]
or
redirect [-w file] [file]
Used with a file name, redirects output of a crash
session to the named file. If no argument is given,
the file name to which output is being redirected is
printed. Alternatively, the close option (-c) closes
the previously set file and redirects output to the
standard output.
region [-e] [-f] [-w file] [[-p]table_entry...]
Print the region table.
length
search [-p] [-w file] [-m mask] [-s process] pattern start_addr
Page 8 May 1989
CRASH(1M) (System Administration Utilities) CRASH(1M)
Print the words in memory that match pattern, beginning
at the start address for length words. The mask is
anded (&) with each memory word and the result compared
against the pattern. The mask defaults to 0xffffffff.
size [-w file] [-x] [structure_name ... ]
Print the size of the designated structure. The (-x)
option prints the size in hexadecimal. If no argument
is given, a list of the structure names for which sizes
are available is printed.
sndd [-e] [-f] [-w file] [[-p]table_entry...]
Print the send descriptor table.
srmount [-e] [-w file] [[-p]table_entry...]
Print the server mount table.
stat [-w file]
Print system statistics.
stream [-e] [-f] [-w file] [[-p]table_entry...]
Print the streams table.
strstat [-w file]
Print streams statistics.
trace [-w file] [process]
or
trace [-w file] [[-p]-istart_addr]
Alias: t.
Print stack trace.
ts [-w file] virtual_address ...
Print closest text symbol to the designated address.
tty [-e] [-f] [-w file] [-ttype[[-p]table_entry...]]
or
Page 9 May 1989
CRASH(1M) (System Administration Utilities) CRASH(1M)
tty [-e] [-f] [-w file] [[-p]start_addr]
Valid types: pp, iu.
Print the tty table. If no arguments are given, the tty
table for both tty types is printed. If the -t option
is used, the table for the single tty type specified is
printed. If no argument follows the type option, all
entries in the table are printed. A single tty entry
may be specified from the start address.
user [-f] [-w file] [process]
Alias: u.
Print the ublock for the designated process.
var [-w file]
Alias: v.
Print the tunable system parameters.
vtop [-w file] [-s process] start_addr...
Print the physical address translation of the virtual
start address.
FILES
/dev/kmem system image of currently running system
BUGS
No facilities are provided for analyzing dumps of systems
contained in other files unless that file is a copy of
kernel memory. Even in that case, examining the user areas
will not work properly in all cases.
Page 10 May 1989