CRASH(1M) RISC/os Reference Manual CRASH(1M)
NAME
crash - examine system images
SYNOPSIS
/etc/crash [ -d dumpfile ] [ -n namelist ] [ -w outputfile ]
DESCRIPTION
The crash command is used to examine the system memory image
of a live or a crashed system by formatting and printing
control structures, tables, and other information. Command
line arguments to crash are dumpfile, namelist, and output-
file.
dumpfile is the file containing the system memory image.
The default dumpfile is /dev/mem. The system image can also
be the pathname of a file (core.*) produced by savecore(1M).
The text file namelist contains the symbol table information
needed for symbolic access to the system memory image to be
examined. The default namelist is /unix. If a system image
from another machine is to be examined, the corresponding
text file must be copied from that machine.
When the crash command is invoked, a session is initiated.
The output from a crash session is directed to outputfile.
The default outputfile is the standard output.
Input during a crash session is of the form:
function [argument ... ]
where function is one of the crash functions described in
the ``FUNCTIONS'' section of this manual page, and arguments
are qualifying data that indicate which items of the system
image are to be printed.
The default for process-related items is the current process
for a running system and the process that was running at the
time of the crash for a crashed system. If the contents of
a table are being dumped, the default is all active table
entries.
The following function options are available to crash func-
tions wherever they are semantically valid.
-e Display every entry in a table.
-f Display the full structure.
-p Interpret all address arguments in the command line as
physical addresses.
Printed 11/19/92 Page 1
CRASH(1M) RISC/os Reference Manual CRASH(1M)
-s process
Specify a process slot other than the default.
-w file
Redirect the output of a function to file.
Note that if the -p option is used, all address and symbol
arguments explicitly entered on the command line will be
interpreted as physical addresses. If they are not physical
addresses, results will be inconsistent.
The functions mode, defproc, and redirect correspond to the
function options -p, -s, and -w. The mode function may be
used to set the address translation mode to physical or vir-
tual for all subsequently entered functions; defproc sets
the value of the process slot argument for subsequent func-
tions; and redirect redirects all subsequent output.
Output from crash functions may be piped to another program
in the following way:
function [argument ... ]!shell_command
For example,
mount ! grep rw
will write all mount table entries with an rw flag to the
standard output. The redirection option (-w) cannot be used
with this feature.
Depending on the context of the function, numeric arguments
will be assumed to be in a specific radix. Counts are
assumed to be decimal. Addresses are always hexadecimal.
Table address arguments larger than the size of the function
table will be interpreted as hexadecimal addresses; those
smaller will be assumed to be decimal slots in the table.
Default bases on all arguments may be overridden. The C
conventions for designating the bases of numbers are recog-
nized. A number that is usually interpreted as decimal will
be interpreted as hexadecimal if it is preceded by 0x and as
octal if it is preceded by 0. Decimal override is desig-
nated by 0d, and binary by 0b.
Aliases for functions may be any uniquely identifiable ini-
tial substring of the function name. Traditional aliases of
one letter, such as p for proc, remain valid.
Many functions accept different forms of entry for the same
argument. Requests for table information will accept a
table entry number, a physical address, a virtual address, a
symbol, a range, or an expression. A range of slot numbers
Page 2 Printed 11/19/92
CRASH(1M) RISC/os Reference Manual CRASH(1M)
may be specified in the form a-b where a and b are decimal
numbers. An expression consists of two operands and an
operator. An operand may be an address, a symbol, or a
number; the operator may be +, -, *, /, &, or |. An operand
which is a number should be preceded by a radix prefix if it
is not a decimal number (0 for octal, 0x for hexidecimal, 0b
for binary). The expression must be enclosed in parentheses
(). Other functions will accept any of these argument forms
that are meaningful.
Two abbreviated arguments to crash functions are used
throughout. Both accept data entered in several forms.
They may be expanded into the following:
table_entry = table entry | address | symbol | range |
expression
start_addr = address | symbol | expression
FUNCTIONS
? [-w file]
List available functions.
!cmd Escape to the shell to execute a command.
base [-w file] number ...
Print number in binary, octal, decimal, and hexa-
decimal. A number in a radix other then decimal
should be preceded by a prefix that indicates its
radix as follows: 0x, hexidecimal; 0, octal; and
0b, binary.
buffer [-w file] [-format] bufferslot
buffer [-w file] [-format] [-p]start_addr
Alias: b.
Print the contents of a buffer in the designated
format. The following format designations are
recognized: -b, byte: -c, character; -d, decimal;
-x, hexadecimal; -o, octal; -r, directory; and -i,
inode. If no format is given, the previous format
is used. The default format at the beginning of a
crash session is hexadecimal.
bufhdr [-f] [-w file] [[-p]table_entry...]
Alias: buf.
Print system buffer headers.
callout [-w file]
Alias: c.
Print the callout table.
dballoc [-w file] [class ... ]
Printed 11/19/92 Page 3
CRASH(1M) RISC/os Reference Manual CRASH(1M)
Print the dballoc table. If a class is entered,
only data block allocation information for that
class will be printed.
dbfree [-w file] [class ... ]
Print free streams data block headers. If a class
is entered, only data block headers for the class
specified will be printed.
dblock [-e] [-w file] [-c classes]
dblock [-e] [-w file] [[-p] table_entry...]
Print allocated streams data block headers. If
the class option (-c) is used, only Streams data
block headers of the class(size) specified will be
printed.
defproc [-w file] [-c]
defproc [-w file] [slot]
Set the value of the process slot argument. The
process slot argument may be set to the current
slot number (-c) or the slot number may be speci-
fied. If no argument is entered, the value of the
previously set slot number is printed. At the
start of a crash session, the process slot is set
to the current process.
dis [-w file] [-a] [-h] start_addr [count]
Disassemble from the start address for count
instructions. The default count is 1. The abso-
lute option (-a) specifies a non-symbolic
disassembly. The option -h means. print register
hardware names instead of register compiler names.
ds [-w file] virtual addresses ...
Print the data symbol whose address is closest to,
but not greater than, the address entered.
file [-e] [-w file] [[-p]table_entry...]
Alias: f.
Print the file table.
findaddr [-w file] table slot
Print the address of slot in table. Only tables
available to the size function are available to
findaddr.
findslot [-w file] virtual_address ...
Print the table, entry slot number, and offset for
the address entered. Only tables available to the
size function are available to findslot.
fs [-w file] [[-p]table_entry...]
Page 4 Printed 11/19/92
CRASH(1M) RISC/os Reference Manual CRASH(1M)
Print the file system information table.
gdp [-e] [-f] [-w file] [[-p]table_entry...]
Print the gift descriptor protocol table.
help [-w file] function ...
Print a description of the named function, includ-
ing syntax and aliases.
inode [-e] [-f] [-w file] [[-p]table_entry...]
Alias: i.
Print the ufs inode table.
linkblk [-e] [-w file] [[-p]table_entry...]
Print the linkblk table.
major [-w file] [entry ...]
Print the MAJOR table.
map [-w file] mapname ...
Print the map structure of the given mapname.
mbfree [-w file]
Print free streams message block headers.
mblock [-e] [-w filename] [-v virt_addrs]
Print allocated streams message block headers.
mbufs [-e] [-w filename] [-v virt_addrs]
Print allocated network mbufs. If the -v option is
specified then the supplied list of virtual
addresses are assumed to correspond to valid
mbufs. In the case when more than one virtual
address appears in the list then they are taken to
comprise a virtual address range. The first will
be used as the starting address with subsequent
increments by the size of a regular mbuf until the
second or ending address is reached.
mbufsfree [-e] [-w filename] [-v virt_addrs]
Print free network mbufs. If the -v option is
specified then the supplied list of virtual
addresses are assumed to correspond to valid
mbufs. In the case when more than one virtual
address appears in the list then they are taken to
comprise a virtual address range. The first will
be used as the starting address with subsequent
increments by the size of a regular mbuf until the
second or ending address is reached.
mode [-w file] [mode]
Set address translation of arguments to virtual
Printed 11/19/92 Page 5
CRASH(1M) RISC/os Reference Manual CRASH(1M)
(v) or physical (p) mode. If no mode argument is
given, the current mode is printed. At the start
of a crash session, the mode is virtual.
mount [-e] [-w file] [[-p]table_entry...]
Alias: m.
Alias: vfs.
Print the vfs mount table.
nm [-w file] symbol ...
Print value and type for the given symbol.
[count]
od [-p] [-w file] [-format] [-mode] [-s process] start_addr
Alias: rd.
Print count values starting at the start address
in one of the following formats: character (-c),
decimal (-d), hexadecimal (-x), octal (-o), ascii
(-a), or hexadecimal/character (-h), and one of
the following modes: long (-l), short (-t), or
byte (-b). The default mode for character and
ascii formats is byte; the default mode for
decimal, hexadecimal, and octal formats is long.
The format -h prints both hexadecimal and charac-
ter representations of the addresses dumped; no
mode needs to be specified. When format or mode
is omitted, the previous value is used. At the
start of a crash session, the format is hexade-
cimal and the mode is long. If no count is
entered, 1 is assumed.
pcb [-w file] [process]
Print the process control block. If no arguments
are given, the pcb for the current process is
printed.
pdt [-e] [-w file] [-s process] uvaddr [count]
pdt [-e] [-w file] [-s process] [-p] start_addr [count]
The page descriptor table of the segment which
includes the user virtual (KUSEG) address uvaddr
is printed. Alternatively, the page descriptor
table starting at the start address for count
entries is printed. If no count is entered, 512
(NPGPT) is assumed.
pfdat [-e] [-w file] [[-p]table_entry...]
Print the pfdata table.
proc [-f] [-w file] [[-p] table_entry ... #procid ...]
proc [-f] [-w file] [-r]
Alias: p.
Print the process table. Process table information
Page 6 Printed 11/19/92
CRASH(1M) RISC/os Reference Manual CRASH(1M)
may be specified in two ways. First, any mixture
of table entries and process ids may be entered.
Each process id must be preceded by a #. Alterna-
tively, process table information for runnable
processes may be specified with the runnable
option (-r).
qrun [-w file]
Print the list of scheduled streams queues.
queue [-f] [-R] [-W] [-w file] [[-p]table_entry...]
Print streams queues. The read option (-R) speci-
fies that the read queue should displayed, even if
the address given is of the write queue of a pair.
The write option (-W) specifies that the write
queue should be displayed, even if the address
given is of the read queue of a pair. The next
option (-n) specifies that the list of queues
pointed to by the q_next field of the write queue
of the specified pair should also be displayed.
quit Alias: q.
Terminate the crash session.
redirect [-w file] [-c]
redirect [-w file] [file]
Used with a file name, redirects output of a crash
session to the named file. If no argument is
given, the file name to which output is being
redirected is printed. Alternatively, the close
option (-c) closes the previously set file and
redirects output to the standard output.
region [-e] [-f] [-w file] [[-p]table_entry...]
Print the region table.
rnode [-f] [-w file] [[-p]table_entry...]
Alias: rn.
Print the NFS rnode table.
length
search [-p] [-w file] [-m mask] [-s process] pattern start_addr
Print the words in memory that match pattern,
beginning at the start address for length words.
The mask is anded (&) with each memory word and
the result compared against the pattern. The mask
defaults to 0xffffffff.
size [-w file] [-x] [structure_name ... ]
Print the size of the designated structure. The
(-x) option prints the size in hexadecimal. If no
argument is given, a list of the structure names
Printed 11/19/92 Page 7
CRASH(1M) RISC/os Reference Manual CRASH(1M)
for which sizes are available is printed.
snode [-e] [-f] [-w file] [[-p]table_entry...]
Alias: sn.
Print the specfs snode table.
stack [-w file] [-u] [process]
stack [-w file] [-k] [process]
Alias: s.
Dump stack. The (-u) option prints the user
stack. The (-k) option prints the kernel stack.
If no arguments are entered, the kernel stack for
the current process is printed.
stat [-w file]
Print system statistics and the putbuf array,
which contains the latest messages printed via the
kernel printf/cmn_err routines.
stream [-e] [-f] [-n] [-w file] [[-p]table_entry...]
Print the streams table. The next option (-n)
specifies that the list of queues associated with
the stream should also be displayed.
strstat [-w file]
Print streams statistics.
strbufs [-e] [-w filename] [-c classes]
strbufs [-e] [-w filename] [-s size] [-v virt_addrs]
Print the allocated streams buffers. If the -c
option is specified then only Streams buffers of
the class(size) are printed. If the -v option is
specified then the supplied list of virtual
addresses are assumed to correspond to valid
stream buffers. In the case when more than one
virtual address appears in the list then the list
is taken as a list of address-pairs specifying a
range of virtual addresses. The first will be
used as the starting address with subsequent
increments by the stream buffer's class size
specified by the -s option, until the second or
ending address is reached. In the event that vir-
tual addresses are supplied but the -s option is
not present then the default Streams buffer size
used will be 32 bytes.
strbufsfree [-e] [-w filename] [-c classes]
strbufsfree [-e] [-w filename] [-s size] [-v
virt_addrs] Print the free streams buffers. If
the -c option is specified then only Streams
buffers of the class(size) are printed. If the -v
option is specified then the supplied list of
Page 8 Printed 11/19/92
CRASH(1M) RISC/os Reference Manual CRASH(1M)
virtual addresses are assumed to correspond to
valid stream buffers. In the case when more than
one virtual address appears in the list then the
list is taken as a list of address-pairs specify-
ing a range of virtual addresses. The first will
be used as the starting address with subsequent
increments by the stream buffer's class size
specified by the -s option, until the second or
ending address is reached. In the event that vir-
tual addresses are supplied but the -s option is
not present then the default Streams buffer size
used will be 32 bytes.
trace [-w file] [-r] [process]
trace [-w file] [-s] [process]
trace [-w file] [-a] [process]
Alias: t.
Print kernel stack trace. The pcb values for sp
and pc are used with the -s option. For -r, crash
looks for a stack trace of maximal length in the
system stack using some heuristics. If these
heuristics lead to an "impossible" stack trace,
other, shorter traces can be tried with the -a
option. If none of the -[rsa] options is given,
-s is used for sleeping processes (SSLEEP or
SXBRK), and -r for running processes.
ts [-w file] virtual_address ...
Print closest text symbol to the designated
address.
user [-f] [-w file] [process]
Alias: u.
Print the ublock for the designated process.
var [-w file]
Alias: v.
Print the tunable system parameters.
vnode [-e] [-f] [-w file] [[-p]table_entry...]
Alias: vn.
Print the vnode table.
vtop [-w file] [-s process] start_addr...
Print the physical address translation of the vir-
tual start address.
FILES
/dev/mem system image of currently running system
SEE ALSO
savecore(1M).
Printed 11/19/92 Page 9