NAME

crash − examine system images

SYNOPSIS

/etc/crash [ −d dumpfile ] [ −n namelist ] [ −w outputfile ]  [ −m ]

DESCRIPTION

The crash command is used to examine the system memory image of a live or a crashed system by formatting and printing control structures, tables, and other information.  Command line arguments to crash are dumpfile, namelist, and outputfile. 

Dumpfile is the file containing the system memory image.  The default dumpfile is /dev/mem.  The system image can also be a regular file or disk partition of dump produced by the boot PROM sysdump command. 

The text file namelist contains the symbol table information needed for symbolic access to the system memory image to be examined.  The default namelist is /unix.  If a system image from another machine is to be examined, the corresponding text file must be copied from that machine. 

When the crash command is invoked, a session is initiated.  The output from a crash session is directed to outputfile.  The default outputfile is the standard output. 

Input during a crash session is of the form:

function [argument ... ]

where function is one of the crash functions described in the “FUNCTIONS” section of this manual page, and arguments are qualifying data that indicate which items of the system image are to be printed. 

The default for process-related items is the process 0 for both running systems and crashed systems.  If the contents of a table are being dumped, the default is all active table entries. 

The −m option is meant for running systems only.  It opens the dump file with write permission so that use of the crash function modify will be allowed. 

The following function options are available to crash functions wherever they are semantically valid. 

−e Display every entry in a table. 

−f Display the full structure. 

−s process
Specify a process slot other than the default.

−v Interpret all address arguments in the command line as virtual addresses. 

−w file
Redirect the output of a function to file. 

The functions defproc and redirect correspond to the function options −s and −w.  defproc sets the value of the process slot argument for subsequent functions; and redirect redirects all subsequent output. 

Output from crash functions may be piped to another program in the following way:

function [argument ... ]!shell_command

For example,

mount ! grep rw

will write all mount table entries with an rw flag to the standard output.  The redirection option (−w) cannot be used with this feature. 

Depending on the context of the function, numeric arguments will be assumed to be in a specific radix.  Counts are assumed to be decimal.  Addresses are always hexadecimal.  Table address arguments larger than the size of the function table will be interpreted as hexadecimal addresses; those smaller will be assumed to be decimal slots in the table.  Default bases on all arguments may be overridden.  The C conventions for designating the bases of numbers are recognized.  A number that is usually interpreted as decimal will be interpreted as hexadecimal if it is preceded by 0x and as octal if it is preceded by 0.  Decimal override is designated by 0d, and binary by 0b. 

Aliases for functions may be any uniquely identifiable initial substring of the function name.  Traditional aliases of one letter, such as p for proc, remain valid. 

Many functions accept different forms of entry for the same argument.  Requests for table information will accept a table entry number, a physical address, a virtual address, a symbol, a range, or an expression.  A range of slot numbers may be specified in the form a−b where a and b are decimal numbers.  An expression consists of two operands and an operator.  An operand may be an address, a symbol, or a number; the operator may be +, −, ∗, /, &, or |.  An operand which is a number should be preceded by a radix prefix if it is not a decimal number (0 for octal, 0x for hexidecimal, 0b for binary).  The expression must be enclosed in parentheses (). Other functions will accept any of these argument forms that are meaningful.

Two abbreviated arguments to crash functions are used throughout.  Both accept data entered in several forms.  They may be expanded into the following:

table_entry = table entry|address|symbol|range|expression

start_addr = address|symbol|expression

FUNCTIONS

? [−w file] List available functions.

!cmd Escape to the shell to execute a command. 

adv [ −e ]
[ −w file ] [ table entry ] Print the advertise table. 

base [−w file] number ...
Print number in binary, octal, decimal, and hexadecimal.  A number in a radix other then decimal should be preceded by a prefix that indicates its radix as follows: 0x, hexidecimal; 0, octal; and 0b, binary. 

buffer [−w file] [−format] bufferslot

or

buffer [−w file] [−format] []start_addr
Alias: b. 
Print the contents of a buffer in the designated format. The following format designations are recognized: −b, byte: −c, character; −d, decimal; −x, hexadecimal; −o, octal; −r, directory; and −i, inode.  If no format is given, the previous format is used.  The default format at the beginning of a crash session is hexadecimal. 

bufhdr [−f] [−w file] [[]table_entry...]
Alias: buf. 
Print system buffer headers.

callout [−w file]
Alias: c. 
Print the callout table.

dballoc [−w file] [class ... ]
Print the dballoc table. If a class is entered, only data block allocation information for that class will be printed.

dbfree  [−w file] [class ... ]
Print free streams data block headers. If a class is entered, only data block headers for the class specified will be printed.

dblock [−e] [−w file] [−c class...]

or

dblock [−e] [−w file] [ table_entry...]
Print allocated streams data block headers. If the class option (−c) is used, only data block headers for the class specified will be printed. 

defproc [−w file] [−c]

or

defproc [−w file] [slot]
Set the value of the process slot argument. The process slot argument may be set to the current slot number (−c) or the slot number may be specified.  If no argument is entered, the value of the previously set slot number is printed.  At the start of a crash session, the process slot is set to process 0. 

dis [−w file] [−a] start_addr [count]
Disassemble from the start address for count instructions.  The default count is 1.  The absolute option (−a) specifies a non-symbolic disassembly. 

ds [−w file] virtual_address ...
Print the data symbol whose address is closest to, but not greater than, the address entered.

file [−e] [−w file] [table_entry...]
Alias: f. 
Print the file table.

findaddr [−w file] table slot
Print the address of slot in table.  Only tables available to the size function are available to findaddr. 

findslot [−w file] virtual_address ...
Print the table, entry slot number, and offset for the address entered. Only tables available to the size function are available to findslot. 

fpu [ −w file] [ −s process] Print the saved FPU registers for designated process.  Defaults to the current value set as the defproc process. 

frame [ −w file] start_addr Formats and displays an exception frame at the designated address. Attempts to provide a stack traceback using the pc and sp from the exception frame. 

fs [−w file] [table_entry...]
Print the file system information table.

gdp [−e] [−f] [−w file] [table_entry...]
Print the gift descriptor protocol table.

help [−w file] function ...
Print a description of the named function, including syntax and aliases.

hint Analyze a crash dump and provide a hint about the cause of the system panic. 

inode [−e] [−f] [−w file] [table_entry...]
Alias: i. 
Print the inode table, including file system switch information.

lck [−e] [−w file] [table_entry...]
Alias: l. 
Print record locking information. If the −e option is used or table address arguments are given, the record lock list is printed.  If no argument is entered, information on locks relative to inodes is printed. 

linkblk [−e] [−w file] [table_entry...]
Print the linkblk table.

map [−w file] mapname ...
Print the map structure of the given mapname.

mbfree [−w file]
Print free streams message block headers.

mblock [−e] [−c] [−n] [−p] [−w filename] [table_entry...]
Print allocated streams message block headers. If the −e option is used, all message headers (including those on the free list) are printed.  The −c option causes the printing to traverse the continuation pointer.  Similarly, the −n option for the next block pointer and −p for the previous block pointer. 

modify
[ −w file] [ −mode ] [ −s process] [ −v ] start_addr Prints the current contents of the location given by start_addr in one of three modes: long ( −l ), short ( −t ), or byte ( −b ).  It then accepts input, allowing the value to be changed.  A carriage return means no change.  A dot (.), or the letter q ( q or Q) stops the command. This is an extremely dangerous command to use on running systems and you should exercise great care in its use.

mount [−e] [−w file] [table_entry...]
Alias: m. 
Print the mount table.

nm [−w file] symbol ...
Print value and type for the given symbol.

nvram [−w file]
Print all the non-volatile RAM variables. 

od [−v] [−w file] [−format] [−mode] [−s process] start_addr [count]
Aliases: rd, d
Print count values starting at the start address in one of the following formats:  character (−c), decimal (−d), hexadecimal (−x), octal (−o), ascii (−a), or hexadecimal/character (−h), and one of the following modes: long (−l), short (−t), or byte (−b).  The default mode for character and ascii formats is byte; the default mode for decimal, hexadecimal, and octal formats is long.  The format −h prints both hexadecimal and character representations of the addresses dumped; no mode needs to be specified.  When format or mode is omitted, the previous value is used.  At the start of a crash session, the format is hexadecimal and the mode is long.  If no count is entered, 1 is assumed. 

pcb [−w file] [−i start_addr]
Print the process control block for the current process.

pdt [−e] [−w file] [−s process] section segment

or

pdt [−w file] start_addr [count]
The page descriptor table starting at the start address for count entries is printed.  If no count is entered, 1 is assumed. 

pfdat [−e] [−f] [−w file] [table_entry...]
Print the pfdata table.

proc [−f] [−w file] [[−p] table_entry ... #procid ...]

or

proc [−f] [−w file] [−r]
Alias: p. 
Print the process table. Process table information may be specified in two ways. First, any mixture of table entries and process ids may be entered. Each process id must be preceded by a #.  Alternatively, process table information for runnable processes may be specified with the runnable option (−r). 

putbuf
[ −w file ] Display the contents of the console logging buffer.  All console messages produced by the kernel are logged to the console. 

qrun [−w file]
Print the list of scheduled streams queues.

queue [−e] [−w file] [table_entry...]
Print streams queues.

quit Alias: q. 
Terminate the crash session. 

r [−w file] [−f] [−e] [−i] [−m] [−g]
Print CPU registers as stored at the time of a panic.  −i prints I/O board registers, −m prints memory board registers, and −g prints graphics board registers. 

rcvd [−e] [−f] [−w file] [table_entry...]
Print the receive descriptor table.

redirect [−w file] [−c]

or

redirect [−w file] [file]
Used with a file name, redirects output of a crash session to the named file.  If no argument is given, the file name to which output is being redirected is printed.  Alternatively, the close option (−c) closes the previously set file and redirects output to the standard output. 

region [−e] [−f] [−w file] [table_entry...]
Print the region table.

rnode [−d] [−e] [−f] [−k] [−w file] [table_entry...]
Alias: rno. 
Print the rnode table. Unless the (−e) option is used, only rnodes which are currently being used are displayed. The (−f) option provides a fuller printout of the rnode structure. The (−d) option displays the contents of the directory/name lookup cache, while (−k) displays all currently locked rnodes. 

search [−w file] [−m mask] [−s process] pattern start_addr length
Print the words in memory that match pattern, beginning at the start address for length words.  The mask is anded (&) with each memory word and the result compared against the pattern.  The mask defaults to 0xffffffff. 

semaphore
[ −w file ] start_addr Print the semaphore data structure for designated semaphores. 

size [−w file] [−x] [structure_name ... ]
Print the size of the designated structure.  The (−x) option prints the size in hexadecimal.  If no argument is given, a list of the structure names for which sizes are available is printed. 

slog [ −w file ] Print the semaphore activity log. 

sndd [−e] [−w file] [table_entry...]
Print the send descriptor table.

srmount [−e] [−w file] [table_entry...]
Print the server mount table.

stack [−w file] [−b] [−s process] [pc sp]
Alias: s. 
Print a stack traceback of pc and sp values for the designated process.  Default is the currently set defproc process.  This command uses the pc and sp values from the pcb in the user area to start the traceback.  These values are incorrect for processes that are active.  Specify pc and sp values for stack traceback of active processes.  The −b option attempts to do a reverse stack traceback starting from the first exception frame. 

stat [−w file]
Print system statistics.

stream [−e] [−f] [−w file] [table_entry...]
Print the streams table.

strstat [−w file]
Print streams statistics.

ts [−w file] virtual_address ...
Print closest text symbol to the designated address.

tty [−e] [−f] [−w file] [−ttype[table_entry...]]

or

tty [−e] [−f] [−w file] [[−p]start_addr]
Valid types: pp, iu. 
Print the tty table. If no arguments are given, the tty table for both tty types is printed. If the −t option is used, the table for the single tty type specified is printed.  If no argument follows the type option, all entries in the table are printed.  A single tty entry may be specified from the start address. 

user [−f] [−w file] [process]
Alias: u. 
Print the ublock for the designated process.

var [−w file]
Alias: v. 
Print the tunable system parameters.

vtop [−w file] [−s process] start_addr...
Print the physical address translation of the virtual start address.

FILES

/dev/memsystem image of currently running system

September 02, 1992