crash(8) — RISC
Name
crash − examine system images
Syntax
/usr/bin/crash [ system ] [ namelist ]
Description
The crash utility is an interactive program that lets you examine the core image of the operating system. This utility has facilities for interpreting and formatting the various control structures in the system and certain miscellaneous functions that are useful when perusing a dump.
The arguments to the crash utility are the file name where the system image can be found and a namelist file to be used for symbol values.
The default values are /dev/mem and /vmunix; hence, the crash utility specified without arguments can be used to examine an active system. If a system image file is given, it is assumed to be a system core dump and the default process is set to be that of the process running at the time of the crash. This is determined by a value stored in a fixed location by the dump mechanism.
Commands
Use the following input to the crash utility:
command [ options ] [ structures ]
If used, options modify the format of the printout. If a specific structure element is not specified, all valid entries are used. For example, proc 12 15 3 prints only process table slots 12, 15, and 3, but proc prints the entire process table in standard format.
In general, those commands that perform I/O with addresses assume hexadecimal on 32-bit machines and octal on 16-bit machines.
The commands include the following:
user [ −a ] [ process table entry ] [ *proc address ] [ #pid ]
Aliases: uarea, u_area, u.
Prints the user structure of the named process as determined by the information contained in the process table entry. If an entry number is not given, the information from the last executing process is printed. Swapped processes produce an error message since their uareas are swapped. If the −a option is specified, the entire user structure is printed in a vertical format with the structure field selector names printed first, followed by their value. The −a format prints many fields that are not printed when −a is not specified.
ufile [ process table entry ] [ *proc address ] [ #pid ]
Prints the open file table for the given process.
trace [ − ] [ process table entry ] [ *proc address ] [ #pid ] [%cpu-number ]
Aliases: t.
Generates a kernel stack trace of a process. The process is either a process slot number, an address of process slot, or the running process. If the process is not running, the trace begins at the pcb. If an entry number is not given, the information from the last executing process will be printed. It is not possible to trace the executing process on a running system. Using the − flag allows the registers and variables for each stack frame to be dumped. When %cpu-number is specified, a trace of the running process on the specified CPU is performed. The %cpu-number cannot be specified in the same trace command as the process slot number, the process slot address, or the process-id.
stack [ −v ] [ process table entry ] [ *proc address ] [ #pid ]
Aliases : s, stk.
Generates a kernel stack dump of a process. This is an unformatted display of the kernel stack. If −v is specified, a formatted display of the VAX kernel stack is given, including saved registers, arguments, and kernel backtrace. For RISC processors, the −v option is accepted but has no effect.
proc [ −a] [ −r] [ process table entry ] [ *proc address ] [ #pid ]
Aliases: p.
Formats the process table. The −a option causes all of the fields of the process table to be printed in a vertical with the structure field selector names first printed, followed by their value. The −a option prints many fields that are not printed when −a is not specified. The −r option causes only runnable processes to be printed.
proclock [ −r] [ process table entry ] [ *proc address ] [ #pid ]
Shows the SMP sleep locks held by a non-running process. Same optional arguments as proc.
pcb [ process table entry ] [ *proc address ] [ #pid ]
Prints the process control block of the current process. The process control block is a part of the user area (VAXen only). If no entry number is given, the information from the last executing process will be printed.
ps [ process table entry ] [ *proc address ] [ #pid ]
Prints the process slots, process id’s, and process names for all processes.
pcb [ process table entry ] [ *proc address ] [ #pid ]
Prints the process control block for the given process.
ppte [ process table entry ] [ *proc address ] [ #pid ]
Prints the pte’s associated with the given process.
spt
Dumps the system page table.
cmap −A
Prints all of the cmap entries.
cmap <page frame number>
Prints the memory freelist or the cmap for the given PFN.
cmap −i index
Prints the core map for the given coremap index.
cmap −h index
Prints the core maps for the given hash starting at index.
cmap −b block
Prints the core maps hashed on the given block.
cmap −a at
Prints the core map at the given address.
cpu [ −a ]
Prints the cpudata table. If −a is specified, all of the fields in the table are printed in vertical format.
smem
Prints shared memory table information. Shared memory configuration information is printed, along with the contents of the shared memory table, for all allocated shared memory segments. Then, for each allocated shared memory segment, information is printed about processes associated with the shared memory segment, and consistency checks are performed to verify that the various data structures linking processes are correct.
shmem shmaddr
Prints information on the shared memory segment at location shmaddr .
prshmem [ process table entry ] [ *proc address ] [ #pid ]
Prints information on all shared memory segments associated with the process.
gnode [ − ] [ gnode table entries ] [ *gnode address ]
Aliases: gno, g.
Formats the gnode table.
gnode −maj <major number>
Formats all gnodes with the given major number.
gnode −min <minor number>
Formats all gnodes with the given minor number.
gnode −fs <mount slot number>
Formats all gnodes for a given file system slot.
gnode −gno <gnode number>
Formats all gnodes with the given gnode number.
gnode −uid <user id>
Formats all gnodes owned by the given uid.
gnode −gid <group id>
Formats all gnodes owned by the given gid.
gnode −lmod <file permissions>
Formats all gnodes with the given protection. The command gnode −lmod 777 finds all gnodes that allow read/write/execute permission to every one.
gnode −hmod <file type>
Formats all gnodes with the given file type. The gnode −hmod 2 command finds all gnodes that are character special files.
gnode −amod <file modesfR>
Formats all gnodes that match the given modes exactly.
gnode −amod 20777
Finds all gnodes for character devices that allow read/write/execute permission to everyone.
gnode −all
Displays a more extensive list of the gnode’s contents.
gnode −lock
Shows the SMP lock contained in the gnode.
gfree
Prints the list of all inactive gnodes.
block [ − ] [ gnode table entries ] [ *gnode address ]
Prints the gnode data block addresses.
rnode [ gnode table entries ] [ *gnode address ]
Alias: v.
Prints the associated rnode values for gnodes that are remote (via NFS).
file [ file table entries ] [ *file address ]
Alias: f.
Formats the file table.
cred address
Prints the credentials at the given address.
crred address
Verifies the references of a credential at the given address.
crcheck
Verifies all references to all credentials.
mount [ −s ] [ mount table entries ] [ *mount address ]
Aliases: mnt, m.
Formats the mount table. The −s option gives a abbreviated format.
fsdata [ mount table entries ] [ *mount address ]
Alias: df.
Prints the fsdata structure associated with a mount entry.
mntinfo [ mount table entries ] [ *mount address ]
Alias: mi.
Prints the mntinfo data structure associate with an NFS file system.
buf [ − ] [ buffer headers ] [ *buffer header address ]
Aliases: hdr, bufhdr.
Formats the system buffer headers. By using the − option, all buffer headers (including ones marked invalid) are printed.
bufgp [ gnode slots ] [ *gnode address ]
Alias: cache.
Prints the buffer headers associated with the given gnode.
buflock
Prints the buffer headers on the locked list.
buflru
Prints the buffer headers on the lru list.
bufage
Prints the buffer headers on the aged list.
bufempty
Prints the buffer headers on the empty list.
buffer [ format ] [ list of buffers ]
Alias: b.
Prints the data in a system buffer according to format. If format is omitted, the previous format is used. Valid formats include decimal, octal, hex, character, byte, directory, gnode, and write. The last creates a file in the current directory (see the Files section) containing the buffer data.
text [ text table entries ] [ *text address ]
Aliases: txt, x.
Formats the text table.
ftext
Alias: freet.
Prints the list of free texts.
callout
Aliases: calls, call, c, timeout, time, tout.
Prints all entries in the callout table.
arp [ − ] [ address ]
Prints the arp table. The − option prints the entire table.
socket [ file slot ] [ *file address ]
Prints the socket structure associated with the given file slot.
tty [ − ] [ process slot ] [ *proc address ] [ #pid ]
Alias: term.
Prints the terminal structure attached to a process. The − option allows for the raw, canonical, and output clists.
tty −clist
Includes clists in display of the tty struct.
tty -addr address
Prints the contents of a tty structure at the specified address.
map [ map names ]
Formats the named system map structures.
nm [ symbols ]
Prints the symbol value and type as found in the namelist file.
ts [ text addresses ]
Finds the closest text symbols to the given addresses.
ds [ data addresses ]
Finds the closest data symbols to the given addresses.
od [ symbol name or address ] [ count ] [ format ]
Aliases: dump, rd.
Dumps count data values starting at the symbol value or address given according to format. Allowable formats are octal, longoct, decimal, longdec, character, hex, or byte.
dis address [ address ]
Disassembles starting at the first address and continuing until the second address. These addresses may be symbolic (that is, syscall+33).
stat
Prints useful statistics pertaining to the buffer cache, dnlc, namei translation cache, and others.
dupreq
Displays the contents of the duplicate request cache. This is useful in finding out the recent history of NFS requests made to the server.
mbuf address
Displays the mbuf chain starting at the given address.
inpcb −udp −tcp
Displays the inpcb chain of the corresponding protocol, or both TCP and UDP if no protocol is specified.
client
Displays the client table, which contains client handles used to initiate rpc requests.
sync
Resynchronizes the proc, mount, gnode, buffer, file and other internal tables up to the current state of /dev/kmem. This command is useful for looking at changing values in runing kernels. However, you chould not use it when looking at vmcore files.
svcxprt address
Prints the svcxprt structure located at address.
cam -controller
Prints SCSI/CAM controller information.
cam -edt
Prints CAM Equipment Device Table (EDT) information.
cam -target
Prints SCSI target information.
cam -devtab
Prints SCSI/CAM Device Descriptor Structure entry information.
cam -cmd
Prints SCSI message and command data.
cam -transfer
Prints SCSI transfer information per target.
cam -bbr
Prints SCSI Bad Block Replacement data.
cam -error
Prints SCSI/CAM error information.
cam -recovery
Prints SCSI direct access device recovery information.
cam -all
Prints all SCSI bus information.
scs
Traverses data structures in the System Communications Services (SCS) tree and displays the contents of the data structures.
scs -cb address
Displays the contents of an SCS connection block data structure at the specified address.
scs -cib address
Displays the contents of an SCS connection information block data structure at the specified address.
scs -pb address
Displays the contents of an SCS path block data structure at the specified address.
scs -pib address
Displays the contents of an SCS path information block data structure at the specified address.
scs -sb address
Displays the contents of an SCS system block data structure at the specified address.
scs -sib address
Displays the contents of an SCS system information block data structure at the specified address.
lock [-all] address
Prints the SMP lock structure located at address. The all flag displays all global SMP locks.
mscp
Traverses both the mscp disk and tape subsystems, and prints the data structures for class blocks, connection blocks, unit blocks, and active request blocks.
mscp -disk
Traverses the mscp disk subsystem and prints the data structures for the mscp class block, mscp connection blocks, mscp unit blocks, and active request blocks.
mscp -tape
Traverses the tmscp tape subsystem and prints the data structures for the tmscp class block, tmscp connection blocks, tmscp unit blocks, and active request blocks.
mscp -config
Traverses both the mscp disk and tape subsystems, and display the system configuration. This is done by printing summary information from the class, connection, and unit blocks.
mscp -connb address
Prints the contents of an mscp connection block at the specified address.
mscp -classb address
Prints the contents of an mscp class block at the specified address.
mscp -unitb address
Prints the contents of an mscp unitb block at the specified address.
mscp -reqb address
Prints the contents of an mscp request block at the specified address.
mscp -dtable
Displays all the elements of the mscp disk unit table. Unused elements of the array will be specified as NULL.
mscp -ttable
Displays all the elements of the tmscp tape unit table. Unused elements of the array will be specified as NULL.
!
Escapes to the shell.
#[ history ]
Repeats the last command. If a number is given (that is, #5), that command number is re-executed.
#h
Alias: history,
Shows the history list.
q
Exits from crash.
?
Prints a synopsis of commands.
Aliases
There are built-in aliases for many of the formats as well as those listed for the commands. Some of them are:
byte
b.
character
char, c.
decimal
dec, e.
directory
direct, dir, d.
hexadecimal
hexadec, hex, h, x.
gnode
gno , g.
longdec
ld, D.
longoct
lo, O.
octal
oct, o.
write
w.
Restrictions
Many of the flags are abbreviated making them difficult to interpret. A source listing of the system header files would be helpful when using the crash utility. Examing the stack of the current process on a running system and processes running at the time of a crash does not work.
Files
/usr/include/sys/∗.h
Header files for table and structure info
/dev/mem
Default system image file
/vmunix
Default namelist file
buf.#
Files created containing buffer data