NAME

crash - examine system images

SYNOPSIS

/usr/sbin/crash [ -d dumpfile ] [ -n namelist ] [ -w ]

DESCRIPTION

The crash command is used to examine the system memory image of a running or a crashed system by formatting and printing control structures, tables, and other information. Command line arguments to crash are dumpfile, namelist, and outputfile.

dumpfile is the file containing the system memory image. The default dumpfile is /dev/mem. The system image can also be /dev/ifdsk06, if the first floppy of a system dump is taken with the sysdump firmware command; or it can be the pathname of a file produced by the ldsysdump command.

The text file namelist contains the symbol table information needed for symbolic access to the system memory image to be examined. The default namelist is /stand/unix. If a system image from another machine is to be examined, the corresponding text file must be copied from that machine.

When the crash command is invoked, a session is initiated. The output from a crash session is directed to outputfile. The default outputfile is the standard output.

Input during a crash session is of the form:

function [ argument...  ]

where function is one of the crash functions described in the ``FUNCTIONS'' subsection of this manual page, and arguments are qualifying data that indicate which items of the system image are to be printed.

The default for process-related items is the current process for a running system or the process that was running at the time of the crash for a crashed system. If the contents of a table are being dumped, the default is all active table entries.

The following function options are available to crash functions wherever they are semantically valid.

-e Display every entry in a table.

-f Display the full structure.

-p Interpret all address arguments in the command line as physical addresses. If they are not physical addresses, results are inconsistent.

-s process

Specify a process slot other than the default.

-w file   Redirect the output of a function to file.

The functions mode, defproc, and redirect correspond to the function options -p, -s, and -w. The mode function may be used to set the address translation mode to physical or virtual for all subsequently entered functions; defproc sets the value of the process slot argument for subsequent functions; and redirect redirects all subsequent output.

Output from crash functions may be piped to another program in the following way:

function [ argument...  ] !  shell_command

For example,

mount ! grep rw

writes all mount table entries with an rw flag to the standard output. The redirection option (-w) cannot be used with this feature.

Depending on the context of the function, numeric arguments are assumed to be in a specific radix. Counts are assumed to be decimal. Addresses are always hexadecimal. Table address arguments larger than the size of the function table are interpreted as hexadecimal addresses; those smaller are assumed to be decimal slots in the table. Default bases on all arguments may be overridden. The C conventions for designating the bases of numbers are recognized. A number that is usually interpreted as decimal is interpreted as hexadecimal if it is preceded by 0x and as octal if it is preceded by 0. Decimal override is designated by 0d, and binary by 0b.

Aliases for functions may be any uniquely identifiable initial substring of the function name. Traditional aliases of one letter, such as p for proc, remain valid.

Many functions accept different forms of entry for the  same
argument.   Requests  for  table  information accept a table
entry number, a physical address, a virtual address, a  sym-
bol,  a range, or an expression. A range of slot numbers may
be specified in the form a-b  where  a  and  b  are  decimal
numbers.   An  expression  consists  of  two operands and an
operator.  An operand may be an  address,  a  symbol,  or  a
number;  the  operator  may  be  +,  -,  *, /, &, or | .  An
operand that is a number should be preceded by a radix  pre-
fix if it is not a decimal number (0 for octal, 0x for hexa-
decimal, 0b for binary).  The expression must be enclosed in
parentheses.   Other  functions accept any of these argument
forms that are meaningful.

Two abbreviated arguments to crash functions are used throughout. Both accept data entered in several forms. They may be expanded into the following:

table_entry = table entry | address | symbol | range  |
expression

start_addr = address | symbol | expression

FUNCTIONS

? [-w file]
     List available functions.

!command

Escape to the shell and execute command.

as [-e] [-f] [-w file] [proc...]

Print information on process segments.

base [-w file] number ...

Print number in binary, octal, decimal, and hexadecimal. A number in a radix other than decimal should be preceded by a prefix that indicates its radix as follows: 0x, hexadecimal; 0, octal; and 0b, binary.

buffer [-w file] [-format] bufferslot

buffer [-w file] [-format] [-p]start_addr
     Alias: b.
     Print the contents of a buffer in the  designated  for-
     mat.  The following format designations are recognized:
     -b, byte: -c, character; -d, decimal; -x,  hexadecimal;
     -o,  octal; and, -i, inode.  If no format is given, the
     previous format is used.  The  default  format  at  the
     beginning of a crash session is hexadecimal.

bufhdr [-f] [-w file] [[-p]table_entry...]
     Alias: buf.
     Print system buffer headers.  The  -f  option  produces
     different  output  depending  on  whether the buffer is
     local or remote (contains RFS data).

callout [-w file]
     Alias: c.
     Print the callout table.

class [-w file] [table_entry...]

Print information about process scheduler classes.

dbfree  [-w file] [class ... ]

Print free streams data block headers. If a class is entered, only data block headers for the class specified is printed.

dblock [-e] [-w file] [-c class...]

dblock [-e] [-w file] [[-p] table_entry...]

Print allocated streams data block headers. If the class option (-c) is used, only data block headers for the class specified is printed.

defproc [-w file] [-c]

defproc [-w file] [slot]

Set the value of the process slot argument. The process slot argument may be set to the current slot number (-c) or the slot number may be specified. If no argument is entered, the value of the previously set slot number is printed. At the start of a crash session, the process slot is set to the current process.

dis [-w file] [-a] start_addr [count]

dis [-w file] [-a] -c [count]

Disassemble count instructions starting at start_addr. The default count is 1. The absolute option (-a) specifies a non-symbolic disassembly. The -c option can be used in place of start_addr to continue disassembly at the address at which a previous disassembly ended.

dispq [-w file] [table_entry...]

Print the dispatcher (scheduler) queues.

ds [-w file] virtual_address ...

Print the data symbol whose address is closest to, but not greater than, the address entered.

file [-e] [-w file] [[-p]table_entry...]
     Alias: f.
     Print the file table.

findaddr [-w file] table slot

Print the address of slot in table. Only tables available to the size function are available to findaddr.

findslot [-w file] virtual_address ...

Print the table, entry slot number, and offset for the address entered. Only tables available to the size function are available to findslot.

fs [-w file] [[-p]table_entry...]

Print the file system information table.

gdp [-e] [-f] [-w file] [[-p]table_entry...]

Print the gift descriptor protocol table.

help [-w file] function ...

Print a description of the named function, including syntax and aliases.

inode [-e] [-f] [-w file] [[-p]table_entry...]
     Alias: i.
     Print the inode table,  including  file  system  switch
     information.

kfp [-w file] [-s process] [-r]

kfp [-w file] [-s process] [value]

Print the kernel frame pointer (kfp) for the start of a kernel stack trace. The kfp value can be set using the value argument or the reset option (-r), which sets the kfp through the nvram (non-volatile RAM). If no argument is entered, the current value of the kfp is printed.

kmastat [-w file]

Print kernel memory allocator statistics.

lck [-e] [-w file] [[-p]table_entry...]
     Alias: l.
     Print record locking information. If the -e  option  is
     used  or  table address arguments are given, the record
     lock list is  printed.   If  no  argument  is  entered,
     information on locks relative to inodes is printed.

linkblk [-e] [-w file] [[-p]table_entry...]

Print the linkblk table.

major [-w file] [entry ...]

Print the MAJOR table.

map [-w file] mapname ...

Print the map structure of the given mapname.

mbfree [-w file]

Print free streams message block headers.

mblock [-e] [-w file] [[-p]table_entry...]

Print allocated streams message block headers.

mmu [-w file]
     Alias: regs.
     Print memory management unit registers.   These  regis-
     ters are not available on a running system.

mode [-w file] [mode]

Set address translation of arguments to virtual (v) or physical (p) mode. If no mode argument is given, the current mode is printed. At the start of a crash session, the mode is virtual.

mount [-e] [-w file] [[-p]table_entry...]
     Alias: m, vfs.
     Print information about mounted file systems.

nm [-w file] symbol ...

Print value and type for the given symbol.

nvram [-w file] type

Print information from non-volatile RAM. type may be fwnvr for firmware nvram, unxnvr for UNIX nvram, systate for system state nvram, or errlog for nvram error log information.

[count]
     od  [-p] [-w  file] [-format] [-mode] [-s   process]   start_addr
          Alias: rd.
          Print count values starting at start_addr in one of the
          following formats:  character (-c), decimal (-d), hexa-
          decimal   (-x),   octal   (-o),    ASCII    (-a),    or
          hexadecimal/character  (-h),  and  one of the following
          modes: long  (-l),  short  (-t),  or  byte  (-b).   The
          default  mode  for character and ASCII formats is byte;
          the default mode for decimal,  hexadecimal,  and  octal
          formats is long.  The format -h prints both hexadecimal
          and character representations of the addresses  dumped;
          no  mode needs to be specified.  When format or mode is
          omitted, the previous value is used.  At the start of a
          crash  session,  the format is hexadecimal and the mode
          is long.  If no count is entered, 1 is assumed.

     page [-e] [-wfile] [[-p] table_entry ...]

Print information about pages.

pcb [-w file] [-u] [process]

pcb [-w file] [-k] [process]

pcb [-w file] [[-p]-i start_addr]

Print the process control block. If no arguments are given, the active pcb for the current process is printed. The user option (-u) prints the user pcb and the kernel option (-k) prints the kernel pcb associated with the process. The interrupt option (-i) prints the interrupt pcb located at start_addr.

prnode [-e] [-w file] [[-p] table_entry...]

Print information about the private data of processes being traced.

proc [-e] [-f] [-w file] [[-p] table_entry ... #procid ...]
proc [-f] [-w file] [-r]
     Alias: p.
     Print the process table. Process table information  may
     be  specified in two ways.  First, any mixture of table
     entries and process IDs may be entered. Each process ID
     must  be preceded by a #.  Alternatively, process table
     information for runnable  processes  may  be  specified
     with the runnable option (-r).

ptbl [-w file] [-sprocess] section  segment [count]

ptbl [-w file] [-sprocess]  [-p]  addr [count]

Print information on page descriptor tables.

pty [-f] [-e] [-w file] [-s] [-h] [-l]

Print the pseudo ttys presently configured. The -l, -h and -h options give information about the STREAMS modules ldterm, ptem and pckt, respectively.

qrun [-w file]

Print the list of scheduled streams queues.

queue [-e] [-w file] [[-p]table_entry...]

Print streams queues.

quit Alias: q.

Terminate the crash session.

rcvd [-e] [-f] [-w file] [[-p]table_entry...]

Print the receive descriptor table.

rduser [-e] [-f] [-w file] [[-p]table_entry...]

Print the receive descriptor user table.

redirect [-w file] [-c]

redirect [-w file] [newfile]

Used with a file name, redirects output of a crash session to newfile. If no argument is given, the file name to which output is being redirected is printed. Alternatively, the close option (-c) closes the previously set file and redirects output to the standard output.

resource [-e] [-w file] [[-p]table_entry...]

Print the advertise table.

rtdptbl [-w file] [table_entry...]

Print the real-time scheduler parameter table. See rt_dptbl(4).

rtproc [-w file]

Print information about processes in the real-time scheduler class.

sdt [-e] [-w file] [-s process] section

sdt [-e] [-w file] [-s process] [-p] start_addr [count]

The segment descriptor table for the named memory section is printed. Alternatively, the segment descriptor table starting at start_addr for count entries is printed. If no count is given, a count of 1 is assumed.

length
     search [-p] [-w file] [-m mask] [-s process] pattern   start_addr
          Print the words in memory that match pattern, beginning
          at the start_addr for length words.  The mask is  ANDed
          (&)  with  each  memory  word  and  the result compared
          against the pattern.  The mask defaults to 0xffffffff.

     size [-w file] [-x] [structure_name ... ]

Print the size of the designated structure. The (-x) option prints the size in hexadecimal. If no argument is given, a list of the structure names for which sizes are available is printed.

sndd [-e] [-f] [-w file] [[-p]table_entry...]

Print the send descriptor table.

snode [-e] [-f] [-w file] [[-p]table_entry...]

Print information about open special files.

sram [-w file]
     Alias: srams
     Print the MMU segment table values.

srmount [-e] [-w file] [[-p]table_entry...]

Print the server mount table.

stack [-w file] [-u] [process]

stack [-w file] [-k] [process]

stack [-w file] [[-p]-i start_addr]
     Alias: s.
     Dump the stack.  The (-u) option prints the user stack.
     The  (-k)  option  prints  the  kernel stack.  The (-i)
     option  prints  the   interrupt   stack   starting   at
     start_addr.   If  no  arguments are entered, the kernel
     stack for the current process is printed.   The  inter-
     rupt  stack  and  the stack for the current process are
     not available on a running system.

stat [-w file]

Print system statistics.

stream [-e] [-f] [-w file] [[-p]table_entry...]

Print the streams table.

strstat [-w file]

Print streams statistics.

trace [-w file] [-r] [process]

trace [-w file] [[-p]-istart_addr]
     Alias: t.
     Print stack trace.  The kfp value is used with  the  -r
     option; the kfp function prints or sets the kfp (kernel
     frame pointer) value.  The interrupt  option  prints  a
     trace  of  the interrupt stack beginning at start_addr.
     The interrupt stack trace and the stack trace  for  the
     current process are not available on a running system.

ts [-w file] virtual_address ...

Print text symbol closest to the designated address.

tsdptbl [-w file] [table_entry...]

Print the time-sharing scheduler parameter table. See ts_dptbl(4).

tsproc [-w file]

Print information about processes in the time-sharing scheduler class.

tty [-e] [-f] [-l] [-w file] [-ttype[[-p]table_entry...]]

tty [-e] [-f] [-l] [-w file] [[-p]start_addr]
     Valid types: pp, iu.
     Print the tty table. If no arguments are given, the tty
     table  for both tty types is printed.  If the -t option
     is used, the table for the single tty type specified is
     printed.   If  no argument follows the type option, all
     entries in the table are printed.  A single  tty  entry
     may  be  specified  using  start_addr.   The  -l option
     prints the line discipline information.

uinode [-e] [-f] [-w file] [[-p]table_entry...]
     Alias: ui.
     Print the ufs inode table.

user [-f] [-w file] [process]
     Alias: u.
     Print the ublock for the designated process.

var [-w file]
     Alias: v.
     Print the tunable system parameters.

vfs [-e] [-w file] [[-p]table_entry...]
     Alias: mount, m.
     Print information about mounted file systems.

vfssw [-w file] [[-p]table_entry...]

Print information about configured file system types.

vnode [-w file] [[-p]vnode_addr...]

Print information about vnodes.

vtop [-w file] [-s process] start_addr...

Print the physical address translation of the virtual address start_addr.

FILES

/dev/mem       system image of currently running system
/dev/ifdsk06   used  to  access  system  image   on   floppy
diskette

SEE ALSO

ldsysdump(1M), firmware(8).