CRASH(8) System Manager's Manual CRASH(8)
crash - examine system images
/etc/crash [ -d dump-file ] [ -n namelist-file ] [ -w output-file ]
crash examines the memory image of a live or a crashed system kernel.
It displays the values of system control structures, tables, and other
Specify the file containing the system memory image. The
default is /dev/mem.
Specify the text file containing the symbol table for sym-
bolic access to the memory image. The default is /vmunix.
If a system image from another machine is to be examined,
the image file must be copied from that machine.
Specify a file for crash output. The default is the stan-
For commands that pertain to a process, the default process is the one
currently running on a live system, or the one that was running at the
time the system crashed.
If the contents of a table are being dumped, the default is all active
Depending on the command, numeric arguments are assumed to be in a spe-
cific base. Counts are assumed to be decimal. Addresses are always
hexadecimal. Table addresses larger than the size of the specified ta-
ble are interpreted as hexadecimal addresses; smaller arguments are
assumed to be in decimal. The default base of any argument may be
overridden; the C conventions for designating the base of a number are
recognized. (A number that is usually interpreted as decimal will be
interpreted as hexadecimal if it is preceded by 0x and as octal if it
is preceded by 0. Decimal override is designated by 0d, and binary by
Many commands accept several forms of an argument. Requests for table
information accept a table entry number, a physical address, a virtual
address, a symbol, a range, or an expression. A range of slot numbers
may be specified in the form a-b where a and b are decimal numbers. An
expression consists of two operands and an operator. An operand may be
an address, a symbol, or a number. The operator may be "+" (plus sign),
"-" (minus sign), "*" (multiplication symbol), "/" (division symbol),
"&&" (logical AND), or "|" (logical OR). An operand which is a number
should be preceded by a radix prefix if it is not a decimal number (0
for octal, 0x for hexidecimal, 0b for binary). The expression must be
enclosed in `()' (parentheses). Other commands accept any of these
argument forms that are meaningful.
Two abbreviated arguments to crash commands are used throughout. Both
accept data entered in several forms. A table_entry argument may be an
address, symbol, range or expression that resolves to one of these. A
start_addr argument may be an address, symbol, or expression that
resolves to one of those.
? [ -w filename ]
List available commands.
Redirect the output of a command to the named
file. Corresponds to the redirect command.
Escape to the shell to execute a command.
adv [ -ep ] [ -w filename ] [ table_entry ] ...
Print the advertise table.
-e Display every entry in a table.
-p Interpret all address arguments in the command
line as physical addresses. With this option, all
address and symbol arguments explicitly entered on
the command line are interpreted as physical
addresses. Corresponds to the mode command.
as [ -wfilename ] [ -p ] proc_entry| #pid [ s ] ]
Print the address space table.
base [ -w filename ] number ...
Print number in binary, octal, decimal, and hexadecimal. A num-
ber in a radix other then decimal should be preceded by a prefix
that indicates its radix as follows: 0x, hexidecimal; 0, octal;
and 0b, binary.
buffer [ -w filename ] [ -format ] bufferslot
buffer [ -p ] [ -w filename ] [ -format ] start_addr
Print the contents of a buffer in the designated format. The
following format designations are recognized: -b, byte; -c,
character; -d, decimal; -x, hexadecimal; -o, octal; -r, direc-
tory; and -i, inode. If no format is given, the previous format
is used. The default format at the beginning of a crash session
bufhdr [ -fp ] [ -w filename ] [ table_entry ] ...
Print system buffer headers.
-f Display the full structure.
[ -w filename ]
Print the callout table.
ctx [ -wfilename ] [ [ -p ] tbl_entry... ]
Print the context table.
dbfree [ -w filename ]
Print free streams data block headers. If a class is entered,
only data block headers for the class specified will be printed.
dblock [ -ep ] [ -w filename ] [ dblk_addr ] ...
Print allocated streams data block headers. If the class option
(-c) is used, only data block headers for the class specified
will be printed.
[ -c ] [ -w filename ]
[ -w filename ] [ slot ]
Set the value of the process slot argument. The process slot
argument may be set to the current slot number (-c) or the slot
number may be specified. If no argument is entered, the value
of the previously set slot number is printed. At the start of a
crash session, the process slot is set to the current process.
ds [ -w filename ] virtual_address ...
Print the data symbol whose address is closest to, but not
greater than, the address entered.
file [ -ep ] [ -w filename ] [ table_entry ] ...
Print the file table.
findaddr [ -w filename ] table slot
Print the address of slot in table. Only tables available to
the size command are available to findaddr.
gdp [ -efp ] [ -w filename ] [ table_entry ] ...
Print the gift descriptor protocol table.
help [ -w filename ] command ...
Print a description of the named command, including syntax and
inode [ -f ] [ -w filename ] [ table_entry ] ...
Print the inode table, including file system switch information.
kfp [ -r ] [ -s process ] [ -w filename ]
kfp [ -s process ] [ -w filename ] [ value ]
Print the frame pointer for the start of a kernel stack trace.
The kfp value can be set using the value argument or the reset
option (-r), which sets the kfp through the nvram. If no argu-
ment is entered, the current value of the kfp is printed.
-s process Specify a process slot other than the
default. Corresponds to the defproc command.
linkblk [ -ep ] [ -w filename ] [ table_entry ] ...
Print the linkblk table.
map [ -w filename ] mapname ...
Print the map structure of mapname.
mbfree [ -w filename ]
Print free streams message block headers.
mblock [ -ep ] [ -w filename ] [ mblk_addr ] ...
Print allocated streams message block headers.
mode [ -w filename ] [ mode ]
Set address translation of arguments to virtual (v) or physical
(p) mode. If no mode argument is given, the current mode is
printed. At the start of a crash session, the mode is virtual.
mount [ -p ] [ -w filename ] [ table_entry ] ...
Print the mount table.
nm [ -w filename ] symbol ...
Print value and type for the given symbol.
od [ -p ] [ -w filename ] [ -format ] [ -mode ] [ -s process ]
start_addr [ count ]
Print count values starting at the start address in one of the
-h hexadecimal character
and one of the following modes:
The default mode for character and ASCII formats is byte; the
default mode for decimal, hexadecimal, and octal formats is
long. The format -h prints both hexadecimal and character rep-
resentations of the addresses dumped; no mode needs to be speci-
fied. When format or mode is omitted, the previous value is
used. At the start of a crash session, the format is hexadeci-
mal and the mode is long. If no count is entered, 1 is assumed.
page [ -e ] [ -wfilename ] [ [ -p ] tbl_entry ] ...
Print the page structures.
pcb [ -w filename ] [ process ]
Print the process control block. If no arguments are given, the
active pcb for the current process is printed. -ep
pment [ -p ] [ -wfilename ] tbl_entry ...
Print the page map entry table (not available on machines with a
sun3x kernel architecture).
pmgrp [ -wfilename ] [ [ -p ] tbl_entry... ]
Print the page map group table (not available on machines with a
sun3x kernel architecture).
proc [ -fp ] [ -w filename ] [ #pid ] ... [ table_entry ] ...
proc [ -fr ] [ -w filename ]
Print the process table. Process table information may be spec-
ified in two ways. First, any mixture of table entries and
process IDs (PID) may be entered. Each PID must be preceded by
a `#' (pound sign). Alternatively, process table information
for runnable processes may be specified with the runnable option
qrun [ -w filename ]
Print the list of scheduled streams queues.
queue [ -p ] [ -w filename ] [ queue_addr ] ...
Print stream queues.
quit Alias: q.
Terminate the crash session.
rcvd [ -efp ] [ -w filename ] [ table_entry ] ...
Print the receive descriptor table.
redirect [ -c ] [ -w filename ]
redirect [ -w filename ] [ filename ]
Used with a name, redirects output of a crash session to the
named file. If no argument is given, the file name to which out-
put is being redirected is printed. Alternatively, the close
option (-c) closes the previously set file and redirects output
to the standard output. To pipe output from a single crash com-
mand, use an exclamation point followed by a shell command:
crash-command ! shell-command
This is not available when -w is in effect.
search [ -p ] [ -m mask ] [ -s process ] [ -w filename ] pat-
tern start_addr length
Print the words in memory that match pattern, beginning at the
start address for length words. The mask is ANDed (&) with each
memory word and the result compared against the pattern. The
mask defaults to 0xffffffff.
seg [ -wfilename ] [ [ -p ] proc_entry ]
seg [ -wfilename ] [ #procid... ]
Print the segment table of process.
segdata [ -wfilename ] [ [ -p ] proc_entry ]
segdata [ -wfilename ] [ #procid... ]
Print the segment data of process.
size [ -x ] [ -w filename ] [ structure_name ... ]
Print the size of the designated structure. The -x option
prints the size in hexadecimal. If no argument is given, a list
of the structure names for which sizes are available is printed.
sndd [ -efp ] [ -w filename ] [ table_entry ] ...
Print the send descriptor table.
srmount [ -ep ] [ -w filename ] [ table_entry ] ...
Print the server mount table.
stack [ -u ] [ -w filename ] [ process ]
stack [ -k ] [ -w filename ] [ process ]
stack [ -p ] [ -w filename ] -i start_addr ]
Dump stack. The -u option prints the user stack. The -k option
prints the kernel stack. The -i option prints the interrupt
stack starting at the start address. If no arguments are
entered, the kernel stack for the current process is printed.
The interrupt stack and the stack for the current process are
not available on a running system.
status [ -w filename ]
Print system statistics.
stream [ -efp ] [ -w filename ] [ table_entry ] ...
Print the streams table.
strstat [ -w filename ]
Print streams statistics.
trace [ -r ] [ -w filename ] [ process ]
trace [ -p ] [ -w filename ] -i start_addr ]
Print stack trace. The kfp value is used with the -r option.
The interrupt option prints a trace of the interrupt stack
beginning at the start address. The interrupt stack trace and
the stack trace for the current process are not available on a
ts [ -w filename ] virtual_address ...
Print closest text symbol to the designated address.
user [ -f ] [ -w filename ] [ process ]
Print the ublock for the designated process.
vfs [ -wfilename ] [ [ -p ] tbl_entry... ]
Print the vfs table.
vnode [ -wfilename ] [ [ -p ] addr ]
Print the vnode table.
vtop [ -s process ] [ -w filename ] start_addr ...
Print the physical address translation of the virtual start
/dev/mem system image of currently running system
26 October 1988 CRASH(8)