crash(ADM) 19 June 1992 crash(ADM) Name crash - examine system images Syntax /etc/crash [ -ddumpfile ] [ -nnamelist ] [ -woutputfile ] Description The crash command is used to examine the system memory image of a live or a crashed system by formatting and printing control structures, tables, and other information. Command line arguments to crash are dumpfile, namelist, and outputfile. dumpfile is the file containing the system memory image. The default dumpfile is /dev/mem. The text file namelist contains the symbol table information needed for symbolic access to the system memory image to be examined. The default namelist is /unix. If a system image from another machine is to be exam- ined, the corresponding text file must be copied from that machine. When the crash command is invoked, a session is initiated. The output from a crash session is directed to outputfile. The default outputfile is the standard output. Input during a crash session is of the form: function [ argument ... ] where function is one of the crash functions described in the Functions section of this manual page, and arguments are qualifying data that indi- cate which items of the system image are to be printed. The default for process-related items is the current process for a run- ning system and the process that was running at the time of the crash for a crashed system. If the contents of a table are being dumped, the default is all active table entries. The following function options are available to crash functions wherever they are semantically valid. -e Display every entry in a table. -f Display the full structure. -p Interpret all address arguments in the command line as phy- sical addresses. -s process Specify a process slot other than the default. -w file Redirect the output of a function to file. Note that if the -p option is used, all address and symbol arguments ex- plicitly entered on the command line will be interpreted as physical addresses. If they are not physical addresses, results will be incon- sistent. The functions mode, defproc, and redirect correspond to the function options -p, -s, and -w. The mode function may be used to set the address translation mode to physical or virtual for all subsequently entered functions; defproc sets the value of the process slot argument for subse- quent functions; and redirect redirects all subsequent output. Output from crash functions may be piped to another program in the fol- lowing way: function [ argument ... ] ! shellcommand For example: mount ! grep rw will write all mount table entries with an rw flag to the standard out- put. The redirection option (-w) cannot be used with this feature. Depending on the context of the function, numeric arguments will be assumed to be in a specific radix. Counts are assumed to be decimal. Addresses are always hexadecimal. Table slot arguments are always decimal. Table slot arguments larger than the size of the function table will not be interpreted correctly. Use the findslot command to translate from an address to a table slot number. Default bases on all arguments may be overridden. The C conventions for designating the bases of num- bers are recognized. A number that is usually interpreted as decimal will be interpreted as hexadecimal if it is preceded by ``0x'' and as octal if it is preceded by ``0''. Decimal override is designated by ``0d'', and binary by ``0b''. Aliases for functions may be any uniquely identifiable initial substring of the function name. Traditional aliases of one letter, such as p for proc, remain valid. Many functions accept different forms of entry for the same argument. Requests for table information will accept a table entry number or a range. A range of slot numbers may be specified in the form a-b where a and b are decimal numbers. An expression consists of two operands and an operator. An operand may be an address, a symbol, or a number; the operator may be any of the following symbols: + - * / & | An operand which is a number should be preceded by a radix prefix if it is not a decimal number (``0'' for octal, ``0x'' for hexadecimal, ``0b'' for binary). The expression must be enclosed in parentheses ( ). Other functions will accept any of these argument forms that are meaningful. Two abbreviated arguments to crash functions are used throughout. Both accept data entered in several forms. They may be expanded into the fol- lowing: tableentry = table entry | range startaddr = address | symbol | expression Functions ? [ -w file ] List available functions. !cmd Escape to the shell to execute a command. adv [ -e ] [ -w file ] [ [ -p ] tableentry ... ] Print the advertise table. (RFS specific) base [ -w file ] number ... Print number in binary, octal, decimal, and hexadecimal. A number in a radix other than decimal should be preceded by a prefix that indicates its radix as follows: ``0x'', hex- adecimal; ``0'', octal; and ``0b'', binary. buffer [ -w file ] [ -format ] bufferslot or buffer [ -w file ] [ -format ] [ -p ] startaddr Alias: b. Print the contents of a buffer in the designated format. The following format designations are recognized: -b, byte: -c, character; -d, decimal; -x, hexadecimal; -o, octal; -r, directory; and -i, inode. If no format is given, the previous format is used. The default format at the beginning of a crash session is hexadecimal. bufhdr [ -f ] [ -w file ] [ [ -p ] tableentry ... ] Alias: buf. Print system buffer headers. callout [ -w file ] Alias: c. Print the callout table. dballoc [ -w file ] [ class ... ] Print the dballoc table. If a class is entered, only data block allocation information for that class will be printed. (Streams specific) dbfree [ -w file ] [ class ... ] Print free streams data block headers. If a class is entered, only data block headers for the class specified will be printed. (Streams specific) dblock [ -e ] [ -w file ] [ -c class ... ] or dblock [ -e ] [ -w file ] [ [ -p ] tableentry ... ] Print allocated streams data block headers. If the class option (-c) is used, only data block headers for the class specified will be printed. (Streams specific) defproc [ -w file ] [ -c ] or defproc [ -w file ] [ slot ] Set the value of the process slot argument. The process slot argument may be set to the current slot number (-c) or the slot number may be specified. If no argument is entered, the value of the previously set slot number is printed. At the start of a crash session, the process slot is set to the current process. dis [ -w file ] [ -a ] startaddr [ count ] Disassemble from the start address for count instructions. The default count is 1. The absolute option (-a) speci- fies a non-symbolic disassembly. ds [ -w file ] virtualaddress ... Print the data symbol whose address is closest to, but not greater than, the address entered. file [ -e ] [ -w file ] [ [ -p ] tableentry ... ] Alias: f. Print the file table. findaddr [ -w file ] tableslot Print the address of slot in table. Only tables available to the size function are available to findaddr. findslot [ -w file ] virtualaddress ... Print the table, entry slot number, and offset for the address entered. Only tables available to the size func- tion are available to findslot. fs [ -w file ] [ [ -p ] tableentry ... ] Print the file system information table. gdp [ -e ] [ -f ] [ -w file ] [ [ -p ] tableentry ... ] Print the gift descriptor protocol table. (RFS specific) gdt [ -e ] [ -w file ] [ [ -p ] tableentry ... ] Print the global descriptor table. help [ -w file ] function ... Print a description of the named function, including syn- tax and aliases. idt [ -e ] [ -w file ] [ [ -p ] tableentry ... ] Print the interrupt descriptor table. inode [ -e ] [ -f ] [ -w file ] [ [ -p ] tableentry ... ] Alias: i. Print the inode table, including file system switch infor- mation. kfp [ -w file ] [ value ] Print the frame pointer for the start of a kernel stack trace. If the value argument is supplied, the kfp is set to that value. lck [ -e ] [ -w file ] [ [ -p ] tableentry ... ] Alias: l. Print record-locking information. If the -e option is used or table address arguments are given, the record lock list is printed. If no argument is entered, information on locks relative to inodes is printed. ldt [ -e ] [ -w file ] [ -s process ] [ [ -p ] tableentry ... ] Print the local descriptor table for the given process, or for the current process if none is given. linkblk [ -e ] [ -w file ] [ [ -p ] tableentry ... ] Print the linkblk table. (Streams specific) map [ -w file ] mapname ... Print the map structure of mapname. mbfree [ -w file ] Print free streams message block headers. (Streams spe- cific) mblock [ -e ] [ -w filename ] [ [ -p ] tableentry ... ] Print allocated streams message block headers. (Streams specific) mode [ -w file ] [ mode ] Set address translation of arguments to virtual (v) or physical (p) mode. If no mode argument is given, the current mode is printed. At the start of a crash session, the mode is virtual. mount [ -e ] [ -w file ] [ [ -p ] tableentry ... ] Alias: m. Print the mount table. nm [ -w file ] symbol ... Print value and type for the given symbol. count ] od [ -p ] [ -w file ] [ -format ] [ -mode ] [ -s process ] startaddr [ Alias: rd. Print count values starting at the start address in one of the following formats: character (-c), decimal (-d), hex- adecimal (-x), octal (-o), ASCII (-a), or hexadecimal/character (-h), and one of the following modes: long (-l), short (-t), or byte (-b). The default mode for character and ASCII formats is byte; the default mode for decimal, hexadecimal, and octal formats is long. The format -h prints both hexadecimal and character representations of the addresses dumped; no mode needs to be specified. When format or mode is omitted, the previ- ous value is used. At the start of a crash session, the format is hexadecimal and the mode is long. If no count is entered, 1 is assumed. Example: > od 0 4 00000000: 0008014c 256471ed 00000000 00000000 > vtop 0 VIRTUAL PHYSICAL SECT SDT SRAM PDT 0 1eb000 0 0 0 0 > od -p 1eb000 4 001eb000: 0008014c 256471ed 00000000 00000000 > mode p Mode = physical > od 1eb000 4 001eb000: 0008014c 256471ed 00000000 00000000 > panic Print the latest system notices, warnings, and panic mes- sages from the limited circular buffer kept in memory. pcb [ -w file ] [ process ] Print the process control block (TSS) for the given pro- cess. If no arguments are given, the active TSS for the current process is printed. pdt [ -e ] [ -w file ] [ -s process ] [ -p ] startaddr [ count ] The page descriptor table of the designated memory section and segment is printed. Alternatively, the page descrip- tor table starting at the start address for count entries is printed. If no count is entered, 1 is assumed. pfdat [ -e ] [ -w file ] [ [ -p ] tableentry ... ] Print the pfdata table. proc [-e] [-f ] [ -w file ] [ [ -p ] tableentry ... #procid ... ] or proc [-f ] [ -w file ] [ -r ] Alias: p. Print the process table. Process table information may be specified in two ways. First, any mixture of table entries and process ids may be entered. Each process id must be preceded by a ``#''. Alternatively, process table information for executable processes may be specified with the executable option (-r). The full option (-f) details most of the information in the process table as well as the region table for that process. qrun [ -w file ] Print the list of scheduled streams queues. (Streams spe- cific) queue [ -e ] [ -w file ] [ [ -p ] tableentry ... ] Print streams queues. (Streams specific) quit Alias: q. Terminate the crash session. rcvd [ -e ] [ -f ] [ -w file ] [ [ -p ] tableentry ... ] Print the receive descriptor table. (RFS specific) redirect [ -w file ] [ -c ] or redirect [ -w file ] [ file ] Used with a filename, redirects output of a crash session to the named file. If no argument is given, the filename to which output is being redirected is printed. Alterna- tively, the close option (-c) closes the previously set file and redirects output to the standard output. region [-e ] [ -w file ] [ [ -p ] tableentry ... ] Print the region table. sdt [ -e ] [ -w file ] [ -s process ] section or sdt [ -e ] [ -w file ] [ -s process ] [ -p ] startaddr [ count ] The segment descriptor table for the current process is printed. count search [ -p ] [ -w file ] [ -m mask ] [ -s process ] pattern startaddr Print the long words in memory that match pattern, begin- ning at the start address for count long words. The mask is ``anded'' (&) with each memory word and the result com- pared against the pattern. The mask defaults to 0xffffffff. Example: > od 0 4 00000000: 0008014c 256471ed 00000000 00000000 > se -m ff ed 0 4 MASK = 0xff, PATTERN = 0xed, START = 0x0, LENGTH = 0x4 MATCH AT 4: 256471ed > size [ -w file ] [ -x ] [ structurename ... ] Print the size of the designated structure. The (-x) option prints the size in hexadecimal. If no argument is given, a list of the structure names for which sizes are available is printed. sndd [ -e ] [ -f ] [ -w file ] [ [ -p ] tableentry ... ] Print the send descriptor table. (RFS specific) srmount [ -e ] [ -w file ] [ [ -p ] tableentry ... ] Print the server mount table. (RFS specific) stack [ -w file ] [ process ] Alias: s. Dump stack. If no arguments are entered, the kernel stack for the current process is printed. Neither the u-area stack associated with the current process or the process's own stack are accessible on a running system. stat [ -w file ] Print system statistics. stream [ -e ] [ -f ] [ -w file ] [ [ -p ] tableentry ... ] Print the streams table. (Streams specific) strstat [ -w file ] Print streams statistics. (Streams specific) trace [ -w file ] [ -r ] [ process ] Alias: t. Print kernel stack trace. The kfp value is used with the -r option. ts [-w file ] virtualaddress ... Print closest text symbol to the designated address. tty [ -e ] [ -f ] [ -w file ] [ -t type [ [ -p ] tableentry ... ] ] Valid types: cn, sio (console, serial ports). Print the tty table. If no arguments are given, the tty table for the console is printed. If the -t option is used, the table for the single tty type specified is printed. If no argument follows the type option, all entries in the table are printed. A single tty entry may be specified from the start address. user [ -f ] [ -w file ] [ process ] Alias: u. Print the ublock for the designated process. var [ -w file ] Alias: v. Print the tunable system parameters. vtop [ -w file ] [ -s process ] startaddr ... Print the physical address translation of the virtual start address. Files /dev/mem system image of currently running system /unix namelist for currently running system